FreePBX Framework Module Authentication Bypass via Forged Authorization Header (CVE-2025-66039)

Metadata

Affected Target

Summary

CVE-2025-66039 is a critical authentication bypass in the FreePBX framework module that occurs when the system’s “Authorization Type” (AUTHTYPE) is configured to webserver — in this mode FreePBX trusts an externally-supplied Authorization header (intended for web-server-level HTTP auth delegation) to determine the logged-in identity, and an attacker can forge that header to log in to the Administrator Control Panel without valid credentials. The root cause is that FreePBX’s webserver auth mode implicitly trusts client-supplied identity data instead of independently verifying it against FreePBX’s own credential store. This mirrored repository does not contain working exploitation code for the bypass itself — it only ships a Nuclei detection template that fingerprints the FreePBX version string from the admin login page and flags instances running versions vulnerable to CVE-2025-66039 (alongside two sibling CVEs in the endpoint module). Successful exploitation of the underlying bug grants full administrative control over the PBX, including call routing, extensions, and voicemail, on unpatched systems.

Vulnerability Details

Root Cause

Per the repository’s own template metadata, the vulnerability is: “Authentication bypass vulnerability in FreePBX that occurs when the ‘Authorization Type’ (AUTHTYPE) is set to ‘webserver’, allowing an attacker to log in to the Administrator Control Panel via a forged Authorization header.” This is a broken/misplaced trust boundary (CWE-287: Improper Authentication / CWE-863: Incorrect Authorization) — the framework module’s authentication logic, when AUTHTYPE=webserver, defers identity decisions to an HTTP header the framework itself does not independently authenticate, rather than validating credentials through FreePBX’s normal login flow. No PHP/exploit code implementing the actual header-forging login bypass is present in this repository; only the following Nuclei template performs non-invasive version detection:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

http:
  - method: GET
    path:
      - '{{BaseURL}}/admin/config.php#'
    extractors:
      - type: regex
        part: body
        name: version
        regex:
          - 'FreePBX\s+([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)'
    matchers:
      - type: word
        part: body
        words: ['FreePBX Administration', 'Operator Panel', 'User Control Panel']
        condition: and
      - type: status
        status: [200]
      - type: dsl
        dsl:
          - compare_versions(version, ">= 16.0.0.0", "< 16.0.44.0") || compare_versions(version, ">= 17.0.0.0", "< 17.0.23.0")

Attack Vector

1. (Detection, as implemented in this repo) Scanner requests GET /admin/config.php on a candidate host and confirms it is a FreePBX admin panel via body-text matchers.
2. Scanner extracts the FreePBX version string from the response body and compares it against the known-vulnerable ranges (< 16.0.44.0 / < 17.0.23.0).
3. If the version falls in the vulnerable range, the target is flagged as susceptible to CVE-2025-66039.
4. (Exploitation, not implemented in this repo, per public advisories) With AUTHTYPE=webserver configured, an attacker crafts an HTTP request with a forged Authorization header claiming an administrative identity and submits it to the FreePBX admin panel, which trusts the header and grants an authenticated administrator session without validating real credentials.

Impact

An attacker exploiting the underlying bypass (not the detection template itself) gains full administrative access to the FreePBX web UI, enabling arbitrary changes to call routing, extensions, trunks, voicemail, and potentially command execution through admin-only modules — a complete compromise of the PBX’s confidentiality, integrity, and availability.

Environment / Lab Setup

Target: FreePBX 16 (< 16.0.44) or FreePBX 17 (< 17.0.23), framework module,
        configured with AUTHTYPE=webserver
Admin panel reachable at http(s)://<target>/admin/config.php

Attacker tooling:
- Nuclei (https://github.com/projectdiscovery/nuclei)
- Templates: CVE-2025-66039.yaml (this CVE), CVE-2025-61675.yaml, CVE-2025-61678.yaml (sibling CVEs, included in same repo)

Proof of Concept

PoC Script

See CVE-2025-66039.yaml in this folder (version-fingerprinting Nuclei template only — no exploitation payload for the auth bypass itself).

1
2
3
4
5
6
7
8

git clone https://github.com/cyberleelawat/FreePBX-Multiple-CVEs-2025.git
cd FreePBX-Multiple-CVEs-2025

nuclei -u https://TARGET -t CVE-2025-66039.yaml

nuclei -l subdomains.txt -t CVE-2025-66039.yaml

nuclei -u https://TARGET -t .

Detection & Indicators of Compromise

GET /admin/config.php with response containing "FreePBX Administration",
"Operator Panel", or "User Control Panel" and an extractable version string
in the vulnerable range (< 16.0.44.0 or < 17.0.23.0).

For actual exploitation (not in this repo): admin panel logins/session
creation with no corresponding entry in FreePBX's normal auth log, or
logins correlating with anomalous/forged Authorization headers when
AUTHTYPE=webserver.

Signs of compromise:

• Administrator sessions established without a matching successful login event in FreePBX’s authentication logs.
• Unexpected changes to extensions, trunks, call routing, or voicemail configuration.
• AUTHTYPE=webserver enabled on internet-facing FreePBX instances.
• Scan traffic hitting /admin/config.php from external IPs followed shortly by administrative actions.

Remediation

References

• Source repository
• CVE-2025-66039 - NVD

Notes

Mirrored from https://github.com/cyberleelawat/FreePBX-Multiple-CVEs-2025 on 2026-07-06. The repository provides only Nuclei detection/fingerprinting templates for CVE-2025-66039 (and two sibling CVEs, CVE-2025-61675 and CVE-2025-61678, also included in this mirror); there is no actual exploitation code for the authentication bypass itself, only version-based vulnerability identification.