CVE-2025-66039 FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
Attackers can bypass authentication and gain administrator access to the FreePBX Endpoint Manager control panel by forging a Basic Auth header when webserver authentication is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66039?
CVE-2025-66039 is a critical authentication bypass vulnerability in Sangoma Freepbx, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.
Weakness: CWE-287
Which versions are affected by CVE-2025-66039?
It affects 1 product.
Products include Sangoma Freepbx.
How do I fix CVE-2025-66039?
No fix has been published for CVE-2025-66039 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-66039 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66039 exists.
Public exploit code: 3 Metasploit modules and 2 proofs of concept on GitHub.
Other vulnerabilities in Sangoma Freepbx
- CVE-2025-57819 Sangoma FreePBX Authentication Bypass
- CVE-2019-19006 Sangoma FreePBX Improper Authentication
- CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
- CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
- CVE-2026-46376 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
Sources
Also known as GHSA-9jvh-mv6x-w698.