Executive brief
FreePBX is an open-source phone system (IP PBX) used by businesses for managing telecommunications. A security flaw in its API module allows an attacker who has obtained a specific internal ID (client_id) to bypass authentication and gain full administrative access to the system's data and settings. This could lead to unauthorized access to call records, configuration changes, or complete control over the phone system's operations.
Technical details
The FreePBX api module (version 17) contains an authentication bypass in its OAuth2 implementation. The `validateClient()` method in `ClientRepository.php` was found to unconditionally return `true`, effectively ignoring the `client_secret` during the `client_credentials` grant flow. An attacker who knows or has obtained a valid `client_id` (typically a 64-character string found in the admin panel or backups) can request OAuth2 access tokens without the corresponding secret. These tokens grant the default `gql` scope, providing full read/write access to all GraphQL mutations and queries. The vulnerability was introduced during the PHP version upgrade for FreePBX v17 and is fixed in version 17.0.8.
Affected products
- FreePBX FreePBX api module < 17.0.8
Timeline
- 2026-05-11: advisory: GitHub advisory published by maintainer
- 2026-05-29: disclosed: CVE published to NVD
- 2026-05-29: patched: Fix released in version 17.0.8