Critical severity9.8NVD Advisory· Published Dec 9, 2025· Updated Jun 17, 2026
CVE-2025-66039
CVE-2025-66039
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: before 16.0.44 and 17.0.23
Patches
Vulnerability mechanics
References
3- github.com/FreePBX/security-reporting/security/advisories/GHSA-9jvh-mv6x-w698nvdMitigationVendor Advisory
- www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80nvdNot ApplicableVendor Advisory
- github.com/FreePBX/framework/commit/04224253156543cd9932b90458660b2f19fc0e35nvdProduct
News mentions
0No linked articles in our index yet.