FreePBX - Authentication Bypass (CVE-2025-66039)
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
psychologyCrowdSec Analysis
CVE-2025-66039 is an authentication bypass in the FreePBX Endpoint Manager module: when the module's authentication type is set to "webserver", any value in the Authorization header binds the session to the targeted user, without valid credentials. Chained with the SQL injection CVE-2025-61675 it gives unauthenticated remote code execution on the PBX.
CrowdSec has been tracking this vulnerability and its exploits since 26th of February 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-66039 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers send requests to the FreePBX administration endpoints with an arbitrary Authorization header to obtain an authenticated session, then chain SQL injection payloads against the admin configuration endpoint.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-12-09 |
| Rule Released | 2026-02-26 |
| CrowdSec First Seen | 2026-03-29 |