Two New High-Severity Flaws in FreePBX Puts Admins and APIs at Risk

The FreePBX project has issued a security advisory for two high-severity flaws, CVE-2025-55209 and CVE-2025-55739, which have now been patched and require users to update promptly, according to the advisory. CVE-2025-55209 is a stored cross-site scripting (XSS) flaw in the User Control Panel Contact Manager widget that can let a low-privileged UCP user inject JavaScript, potentially hijacking sessions or escalating privileges when an administrator interacts with the affected area.

CVE-2025-55739 concerns an OAuth private key reused across systems installed from the same FreePBX RPM or DEB package, enabling an attacker to forge JWTs, bypass authentication and gain full API access if the api module is enabled. The advisory explains that each system now generates a unique OAuth key during API module installation to remove cross-instance token forgery risks, and it provides steps to apply patches, regenerate tokens and verify token handling, permissions and logs.

Users are advised to update the API module, regenerate tokens, and check for suspicious activity, with additional commands such as fwconsole chown to ensure updated key permissions.