# CVE-2025-66039: FreePBX - Authentication Bypass

> Live exploitation tracking for CVE-2025-66039 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-66039

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Sangoma FreePBX
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** php, management_panel

## Description

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.

## CrowdSec analysis

[CVE-2025-66039](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-66039) is an authentication bypass in the FreePBX Endpoint Manager module: when the module's authentication type is set to "webserver", any value in the Authorization header binds the session to the targeted user, without valid credentials. Chained with the SQL injection CVE-2025-61675 it gives unauthenticated remote code execution on the PBX.

CrowdSec has been tracking this vulnerability and its exploits since 26th of February 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-66039 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send requests to the FreePBX administration endpoints with an arbitrary Authorization header to obtain an authenticated session, then chain SQL injection payloads against the admin configuration endpoint.

## Timeline

- 2025-12-09: CVE Published. CVE-2025-66039 is published to NVD.
- 2026-02-26: Rule Released. CrowdSec releases a rule to detect CVE-2025-66039 exploitation attempts against the CrowdSec Network.
- 2026-03-29: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-66039 for the first time.

## References

- https://github.com/FreePBX/framework/commit/04224253156543cd9932b90458660b2f19fc0e35#diff-72f14a52840a61504a8e03cd195035b44e488aecd634b001bc6412a04bdc940bR20-R50
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9jvh-mv6x-w698

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-66039) follows observed exploitation activity for CVE-2025-66039. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.