CVE-2026-44237: FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid clientid is required. The validateClient() method in ClientRepository.php unconditionally returns true, allowing any party with knowledge of a valid clientid to obtain OAuth2 access tokens without providing the correct clientsecret. This vulnerability is fixed in 17.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX api module (OAuth2 implementation)to a version that resolves this vulnerability.Fixed in 17.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44237?
CVE-2026-44237 has a severity rating of 7.6, classified as high.
How do I fix CVE-2026-44237?
To fix CVE-2026-44237, update FreePBX to version 17.0.8 or later.
What type of vulnerability is CVE-2026-44237?
CVE-2026-44237 is an authenticated access vulnerability that can lead to an OAuth2 authentication bypass.
What are the potential impacts of CVE-2026-44237?
CVE-2026-44237 can allow attackers with knowledge of a valid client_id to bypass OAuth2 authentication.
In which software is CVE-2026-44237 found?
CVE-2026-44237 is found in the FreePBX API module of FreePBX prior to version 17.0.8.