CVE-2025-66039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66039
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66039.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66039
Aliases
  • GHSA-9jvh-mv6x-w698
Published
2025-12-09T21:32:03Z
Modified
2026-10-28T02:30:59Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
Details

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an arbitrary value, a session is associated with the target user regardless of valid credentials. This issue is fixed in versions 16.0.44 and 17.0.23.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-287"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66039.json"
}
References

Affected packages

Git / github.com/freepbx/core

Affected ranges

Type
GIT
Repo
https://github.com/freepbx/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
39c57543e3b75a727bb0e3bf6b1194a2c221f67a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "16.0.44"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/freepbx/framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fb5c32d6e3e849a9c6ae11963e732e8aee7f756e
Introduced
80f08018fdc77e0e2316ab3d9316d601fdafc7b7
Fixed
a3406d89bd14d4e621fd428d77d157d0d75efd49
Fixed
04224253156543cd9932b90458660b2f19fc0e35
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "16.0.44"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "17.0.1"
                },
                {
                    "fixed":  "17.0.23"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "04224253156543cd9932b90458660b2f19fc0e35"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

release/12.*
release/12.0.1alpha11
release/12.0.1alpha12
release/12.0.1alpha16
release/12.0.1alpha17
release/12.0.1alpha18
release/12.0.1alpha19
release/12.0.1alpha2
release/12.0.1alpha20
release/12.0.1alpha21
release/12.0.1alpha22
release/12.0.1alpha23
release/12.0.1alpha24
release/12.0.1alpha25
release/12.0.1alpha3
release/12.0.1alpha4
release/12.0.1alpha5
release/12.0.1alpha6
release/12.0.1alpha7
release/12.0.1alpha9
release/12.0.1beta10
release/12.0.1beta11
release/12.0.1beta3
release/12.0.1beta4
release/12.0.1beta5
release/12.0.1beta6
release/12.0.1beta7
release/12.0.1beta8
release/12.0.1beta9
release/12.0.1rc1
release/12.0.1rc2
release/12.0.1rc3
release/12.0.1rc4
release/12.0.1rc6
release/12.0.1rc7
release/13.*
release/13.0.10
release/13.0.11
release/13.0.13
release/13.0.14
release/13.0.15
release/13.0.16
release/13.0.17
release/13.0.18
release/13.0.19
release/13.0.1RC1.0
release/13.0.1RC1.1
release/13.0.1RC1.10
release/13.0.1RC1.11
release/13.0.1RC1.12
release/13.0.1RC1.13
release/13.0.1RC1.14
release/13.0.1RC1.15
release/13.0.1RC1.16
release/13.0.1RC1.2
release/13.0.1RC1.3
release/13.0.1RC1.4
release/13.0.1RC1.5
release/13.0.1RC1.6
release/13.0.1RC1.7
release/13.0.1RC1.8
release/13.0.1RC1.9
release/13.0.1alpha10
release/13.0.1alpha11
release/13.0.1alpha12
release/13.0.1alpha13
release/13.0.1alpha14
release/13.0.1alpha15
release/13.0.1alpha16
release/13.0.1alpha17
release/13.0.1alpha18
release/13.0.1alpha19
release/13.0.1alpha2
release/13.0.1alpha20
release/13.0.1alpha21
release/13.0.1alpha3
release/13.0.1alpha34
release/13.0.1alpha5
release/13.0.1alpha6
release/13.0.1alpha7
release/13.0.1alpha8
release/13.0.1alpha9
release/13.0.1beta1
release/13.0.1beta1.10
release/13.0.1beta1.11
release/13.0.1beta1.12
release/13.0.1beta1.13
release/13.0.1beta1.14
release/13.0.1beta1.15
release/13.0.1beta1.16
release/13.0.1beta1.17
release/13.0.1beta1.18
release/13.0.1beta1.19
release/13.0.1beta1.2
release/13.0.1beta1.20
release/13.0.1beta1.21
release/13.0.1beta1.22
release/13.0.1beta1.23
release/13.0.1beta1.24
release/13.0.1beta1.25
release/13.0.1beta1.26
release/13.0.1beta1.27
release/13.0.1beta1.28
release/13.0.1beta1.29
release/13.0.1beta1.3
release/13.0.1beta1.4
release/13.0.1beta1.5
release/13.0.1beta1.6
release/13.0.1beta1.7
release/13.0.1beta1.8
release/13.0.1beta1.9
release/13.0.2
release/13.0.20
release/13.0.21
release/13.0.22
release/13.0.23
release/13.0.24
release/13.0.25
release/13.0.26
release/13.0.27
release/13.0.28
release/13.0.29
release/13.0.3
release/13.0.30
release/13.0.31
release/13.0.33
release/13.0.34
release/13.0.35
release/13.0.36
release/13.0.37
release/13.0.38
release/13.0.38.1
release/13.0.38.2
release/13.0.39
release/13.0.4
release/13.0.40
release/13.0.41
release/13.0.42
release/13.0.43
release/13.0.44
release/13.0.45
release/13.0.46
release/13.0.47
release/13.0.48
release/13.0.49
release/13.0.5
release/13.0.50
release/13.0.51
release/13.0.52
release/13.0.53
release/13.0.54
release/13.0.55
release/13.0.56
release/13.0.57
release/13.0.58
release/13.0.59
release/13.0.6
release/13.0.60
release/13.0.61
release/13.0.62
release/13.0.63
release/13.0.65
release/13.0.66
release/13.0.67
release/13.0.68
release/13.0.69
release/13.0.7
release/13.0.70
release/13.0.71
release/13.0.72
release/13.0.73
release/13.0.74
release/13.0.75
release/13.0.76
release/13.0.77
release/13.0.78
release/13.0.79
release/13.0.8
release/13.0.80
release/13.0.81
release/13.0.82
release/13.0.83
release/13.0.84
release/13.0.85
release/13.0.86
release/13.0.9
release/14.*
release/14.0.1
release/14.0.1.1
release/14.0.1.10
release/14.0.1.11
release/14.0.1.12
release/14.0.1.13
release/14.0.1.14
release/14.0.1.15
release/14.0.1.16
release/14.0.1.17
release/14.0.1.18
release/14.0.1.19
release/14.0.1.2
release/14.0.1.21
release/14.0.1.22
release/14.0.1.23
release/14.0.1.24
release/14.0.1.25
release/14.0.1.3
release/14.0.1.4
release/14.0.1.5
release/14.0.1.7
release/14.0.1.8
release/14.0.1.9
release/14.0.1alpha1
release/14.0.1alpha10
release/14.0.1alpha11
release/14.0.1alpha12
release/14.0.1alpha13
release/14.0.1alpha14
release/14.0.1alpha15
release/14.0.1alpha16
release/14.0.1alpha2
release/14.0.1alpha3
release/14.0.1alpha4
release/14.0.1alpha5
release/14.0.1alpha6
release/14.0.1alpha7
release/14.0.1alpha8
release/14.0.1alpha9
release/14.0.1beta10
release/14.0.1beta2
release/14.0.1beta3
release/14.0.1beta4
release/14.0.1beta5
release/14.0.1beta7
release/14.0.1beta8
release/14.0.1beta9
release/14.0.1rc1
release/14.0.1rc1.1
release/14.0.1rc1.10
release/14.0.1rc1.11
release/14.0.1rc1.12
release/14.0.1rc1.2
release/14.0.1rc1.3
release/14.0.1rc1.4
release/14.0.1rc1.5
release/14.0.1rc1.6
release/14.0.1rc1.7
release/14.0.1rc1.8
release/14.0.1rc1.9
release/14.0.2
release/14.0.3
release/15.*
release/15.0.1alpha2
release/15.0.1alpha3
release/15.0.1beta1
release/15.0.1beta2
release/15.0.1beta3
release/15.0.1beta4
release/15.0.1beta5
release/15.0.1beta6
release/15.0.1beta7
release/15.0.1beta8
release/15.0.2
release/15.0.3.1
release/15.0.3.10
release/15.0.3.11
release/15.0.3.13
release/15.0.3.14
release/15.0.3.15
release/15.0.3.16
release/15.0.3.17
release/15.0.3.18
release/15.0.3.19
release/15.0.3.2
release/15.0.3.20
release/15.0.3.21
release/15.0.3.22
release/15.0.3.23
release/15.0.3.24
release/15.0.3.25
release/15.0.3.26
release/15.0.3.27
release/15.0.3.3
release/15.0.3.4
release/15.0.3.5
release/15.0.3.6
release/15.0.3.8
release/15.0.3.9
release/15.0.4
release/15.0.5
release/15.0.6
release/15.0.7
release/15.0.8
release/15.0.9
release/15.0.9.1
release/15.0.9.10
release/15.0.9.11
release/15.0.9.12
release/15.0.9.13
release/15.0.9.14
release/15.0.9.15
release/15.0.9.16
release/15.0.9.17
release/15.0.9.18
release/15.0.9.19
release/15.0.9.2
release/15.0.9.21
release/15.0.9.22
release/15.0.9.23
release/15.0.9.24
release/15.0.9.25
release/15.0.9.26
release/15.0.9.27
release/15.0.9.28
release/15.0.9.29
release/15.0.9.30
release/15.0.9.31
release/15.0.9.32
release/15.0.9.33
release/15.0.9.34
release/15.0.9.35
release/15.0.9.36
release/15.0.9.37
release/15.0.9.38
release/15.0.9.39
release/15.0.9.4
release/15.0.9.40
release/15.0.9.41
release/15.0.9.42
release/15.0.9.43
release/15.0.9.44
release/15.0.9.45
release/15.0.9.46
release/15.0.9.47
release/15.0.9.48
release/15.0.9.49
release/15.0.9.5
release/15.0.9.50
release/15.0.9.51
release/15.0.9.52
release/15.0.9.53
release/15.0.9.54
release/15.0.9.55
release/15.0.9.56
release/15.0.9.57
release/15.0.9.58
release/15.0.9.59
release/15.0.9.6
release/15.0.9.60
release/15.0.9.61
release/15.0.9.62
release/15.0.9.63
release/15.0.9.64
release/15.0.9.65
release/15.0.9.66
release/15.0.9.67
release/15.0.9.68
release/15.0.9.69
release/15.0.9.7
release/15.0.9.8
release/15.0.9.9
release/16.*
release/16.0.10
release/16.0.11
release/16.0.12
release/16.0.13
release/16.0.14
release/16.0.15
release/16.0.16
release/16.0.17
release/16.0.18
release/16.0.19
release/16.0.20
release/16.0.21
release/16.0.22
release/16.0.23
release/16.0.24
release/16.0.25
release/16.0.26
release/16.0.27
release/16.0.28
release/16.0.29
release/16.0.3
release/16.0.30
release/16.0.31
release/16.0.32
release/16.0.33
release/16.0.34
release/16.0.35
release/16.0.36
release/16.0.37
release/16.0.38
release/16.0.39
release/16.0.4
release/16.0.40
release/16.0.41
release/16.0.42
release/16.0.43
release/16.0.5
release/16.0.6
release/16.0.7
release/16.0.8
release/16.0.9
release/17.*
release/17.0.1
release/17.0.10
release/17.0.11
release/17.0.12
release/17.0.13
release/17.0.14
release/17.0.14.1
release/17.0.14.10
release/17.0.14.11
release/17.0.14.12
release/17.0.14.13
release/17.0.14.14
release/17.0.14.15
release/17.0.14.16
release/17.0.14.17
release/17.0.14.18
release/17.0.14.19
release/17.0.14.2
release/17.0.14.20
release/17.0.14.21
release/17.0.14.22
release/17.0.14.23
release/17.0.14.24
release/17.0.14.25
release/17.0.14.26
release/17.0.14.27
release/17.0.14.28
release/17.0.14.29
release/17.0.14.3
release/17.0.14.30
release/17.0.14.31
release/17.0.14.32
release/17.0.14.33
release/17.0.14.34
release/17.0.14.35
release/17.0.14.36
release/17.0.14.37
release/17.0.14.38
release/17.0.14.4
release/17.0.14.5
release/17.0.14.6
release/17.0.14.7
release/17.0.14.8
release/17.0.14.9
release/17.0.15
release/17.0.15.1
release/17.0.15.10
release/17.0.15.11
release/17.0.15.12
release/17.0.15.13
release/17.0.15.14
release/17.0.15.15
release/17.0.15.16
release/17.0.15.17
release/17.0.15.18
release/17.0.15.19
release/17.0.15.2
release/17.0.15.20
release/17.0.15.21
release/17.0.15.22
release/17.0.15.23
release/17.0.15.24
release/17.0.15.25
release/17.0.15.26
release/17.0.15.27
release/17.0.15.28
release/17.0.15.3
release/17.0.15.4
release/17.0.15.5
release/17.0.15.6
release/17.0.15.7
release/17.0.15.8
release/17.0.15.9
release/17.0.16
release/17.0.17
release/17.0.17.1
release/17.0.18
release/17.0.19
release/17.0.19.1
release/17.0.19.10
release/17.0.19.11
release/17.0.19.12
release/17.0.19.13
release/17.0.19.14
release/17.0.19.15
release/17.0.19.16
release/17.0.19.17
release/17.0.19.18
release/17.0.19.19
release/17.0.19.2
release/17.0.19.20
release/17.0.19.21
release/17.0.19.22
release/17.0.19.23
release/17.0.19.24
release/17.0.19.25
release/17.0.19.26
release/17.0.19.27
release/17.0.19.28
release/17.0.19.29
release/17.0.19.3
release/17.0.19.30
release/17.0.19.31
release/17.0.19.32
release/17.0.19.33
release/17.0.19.34
release/17.0.19.35
release/17.0.19.4
release/17.0.19.5
release/17.0.19.6
release/17.0.19.7
release/17.0.19.8
release/17.0.19.9
release/17.0.2
release/17.0.20
release/17.0.20.1
release/17.0.21
release/17.0.21.1
release/17.0.21.10
release/17.0.21.11
release/17.0.21.12
release/17.0.21.2
release/17.0.21.3
release/17.0.21.4
release/17.0.21.5
release/17.0.21.6
release/17.0.21.7
release/17.0.21.8
release/17.0.21.9
release/17.0.22
release/17.0.3
release/17.0.4
release/17.0.7
release/17.0.8
release/17.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66039.json"