What’s Vulnerable › Vulnerabilities
CVE-2026-44237: FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-29 · updated 2026-07-21
- Weakness: CWE-1390
Description
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret. This vulnerability is fixed in 17.0.8.
Affected products
- Sangoma FreePBX: before 17.0.8 — fixed in 17.0.8
How to fix
Upgrade to a fixed version: Sangoma FreePBX 17.0.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44237 or the next vulnerability affects your stack