CVE-2026-44237: FreePBX OAuth2 Client Credential Bypass Vulnerability

Technical summary

The vulnerability exists in the validateClient() method within ClientRepository.php of the FreePBX api module. The method fails to perform server-side validation of the client_secret parameter during OAuth2 token issuance, instead returning true regardless of credentials supplied. An attacker possessing knowledge of a valid client_id can craft token requests that bypass authentication checks, obtaining valid OAuth2 bearer tokens without cryptographic proof of the client_secret. This represents a broken authentication control at the token issuance layer, violating OAuth2 specification requirements for client confidentiality.

Business impact

Compromise of OAuth2 token issuance undermines the security boundary between external API consumers and the FreePBX system. Threat actors obtaining valid tokens can perform API operations at the privilege level of the compromised application context, potentially including retrieval of call records, user directories, configuration changes, and call routing manipulation. For hosted or multi-tenant deployments, this escalates the risk of lateral movement and data exfiltration. Organizations depending on API-driven automation or third-party integrations face heightened exposure if those client_ids become known to adversaries.

Affected systems

FreePBX versions prior to 17.0.8 are affected. The vulnerability requires the presence of the api module and applicable only to deployments where OAuth2 is enabled or configured. Both open-source FreePBX instances and systems running under Sangoma's supported FreePBX offerings are in scope. Self-hosted and cloud-based deployments using affected versions face the same risk.

Exploitability

Exploitation requires network access to the FreePBX API endpoint and knowledge of a valid client_id. No user interaction is required, and attack complexity is low—an attacker can attempt token requests programmatically. The CVSS scoring (8.1 HIGH, AV:N/AC:L/PR:L) indicates network-based exploitability with low complexity; the PR:L (Privileges Required: Low) component reflects that possession of a valid client_id—itself a form of partial knowledge—is the primary barrier. Client IDs may be discoverable through misconfiguration, documentation, integration details, or prior reconnaissance.

Remediation

Upgrade FreePBX to version 17.0.8 or later, which corrects the validateClient() logic to properly verify client_secret credentials. Apply the patch through your package manager or FreePBX administration interface. Organizations unable to patch immediately should restrict API endpoint access via network controls (IP allowlisting, VPN requirements) and audit OAuth2 token issuance logs for anomalous patterns.

Patch guidance

FreePBX 17.0.8 contains the corrected implementation. Administrators should verify the running version via the FreePBX web console (Settings > System Settings > System Version) and apply updates through the standard FreePBX module update process. After patching, test OAuth2 token requests to confirm that invalid client_secret values are now rejected. No configuration changes are necessary post-patch; existing tokens remain valid until their natural expiration.

Detection guidance

Monitor FreePBX API logs and OAuth2 token issuance records for token requests using unexpected or dormant client_ids. Examine authentication failure logs for repeated failed secret validation attempts, which may indicate scanning or brute-force activity. Network-based detection should flag suspicious API calls authenticated with tokens issued shortly after suspicious token requests. Review integration documentation and client_id assignments to establish a baseline of legitimate API consumers and flag anomalies.

Why prioritize this

The vulnerability enables unauthenticated access to a critical administrative interface (the FreePBX API) with minimal preconditions. The HIGH severity reflects both the scope (confidentiality and integrity impact on API operations) and the practical exploitability (no user interaction, low complexity, network-accessible). Organizations operating FreePBX as a core voice or communications platform should treat this as a near-term remediation priority, particularly if the system is exposed to untrusted networks or if multiple external integrations consume the API.

Risk score, explained

CVSS 3.1 score of 8.1 (HIGH) reflects: network-based attack vector, low attack complexity, requirement for knowledge of a valid client_id (PR:L), no user interaction, unchanged scope, and high impact to confidentiality and integrity of API operations. The score does not assume compromise of the client_secret itself, only its bypass; systems with strong client_id confidentiality practices face lower practical risk than those with widely-known or poorly-managed credentials.

Frequently asked questions