Loading vulnerability…
Authentication Bypass in FreePBX Endpoint Manager Webserver Auth Mode
CVE-2025-66039 is a critical improper authentication vulnerability in the FreePBX Endpoint Manager module. When the module is configured to use the "webserver" authorization type, the application incorrectly trusts a supplied Authorization header and associates a session with the targeted user even if the credentials are invalid or arbitrary. This allows an unauthenticated remote attacker to bypass normal login checks and authenticate as an arbitrary user, including access to the Administrator Control Panel. The flaw affects deployments using the legacy webserver-based authentication mode and was fixed in Endpoint Manager versions 16.0.44 and 17.0.23.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized access to protected Endpoint Manager functionality as the impersonated user. Depending on the targeted account, this can result in administrative access to the FreePBX control plane, bypass of security controls, unauthorized modification of telephony endpoint configuration, and a foothold for chaining with other Endpoint Manager vulnerabilities to achieve broader compromise, including database manipulation or remote code execution through separate flaws.
If you can’t patch tonight, do this now.
Do not use the "webserver" authorization type. Set the Authorization Type to "usermanager". Additional hardening guidance associated with exposed configurations includes disabling the advanced settings "Display Friendly Name," "Display Readonly Settings," and "Override Readonly Settings," then restarting the system to invalidate any rogue sessions. If webserver-based authorization had been enabled, administrators should audit the instance for possible compromise.
Patch, then assume compromise.
Upgrade FreePBX Endpoint Manager to a fixed release. The vulnerability is fixed in versions 16.0.44 and 17.0.23. Where broader Endpoint Manager issues are also a concern, organizations should ensure all related security updates for the platform are applied. After updating, verify that insecure legacy authentication settings are no longer in use and review administrative accounts and recent configuration activity for signs of unauthorized access.
1 exploit validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 3 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.