Critical FreePBX Flaw (CVE-2025-66039) Risks PBX Takeover via Authentication Bypass in ‘webserver’ Auth Mode

A critical vulnerability in FreePBX, CVE-2025-66039, could allow unauthorised access to the full administrative interface, potentially enabling a complete PBX takeover when the system is configured to use “webserver” as its authentication type. The flaw, which carries a CVSS score of 9.3, arises from a logic error in the Administrator Control Panel that is triggered by a crafted HTTP request with an arbitrary Authorization header.

It affects FreePBX versions prior to 16.0.44 and 17.0.23, with patches released in those respective versions. For those unable to update immediately, the advisory recommends changing the configuration to mitigate the risk by switching the Authorization Type to “usermanager” via fwconsole setting AUTHTYPE usermanager, or checking the current setting with fwconsole setting --list | grep -i authtype.

The article also notes that proper firewalling can greatly assist in mitigating the effects of this issue, emphasising that administrative interfaces should not be exposed to the open internet.