CVE-2026-44237 Details
Description
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.
An authentication bypass vulnerability has been identified in the FreePBX API module's OAuth2 implementation, prior to version 17.0.8. The issue arises because the implementation does not properly validate client credentials during token issuance. Specifically, the validateClient() method in ClientRepository.php always returns true, allowing anyone with knowledge of a valid client_id to obtain OAuth2 access tokens without the corresponding client_secret. This vulnerability requires the API module to be installed with at least one OAuth2 application configured.
Users are advised to update the API module to the latest version. Additionally, ensure that only authorized users have access to the FreePBX Administrator Control Panel, and consider using the FreePBX User Management, SysAdmin VPN, MFA or SAML modules for added security. It is also recommended to deny access from hostile networks to the ACP using the FreePBX Firewall module, and to maintain secure control of backups.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vgjf-4h63-8vcc | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1390 | Weak Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sangoma freepbx | < 17.0.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 29, 2026 | New CVE Received | [email protected] |