CVE-2026-44237: FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

Synopsis

This is an OAuth2 authentication bypass in the FreePBX api module. The flaw is reachable over the network and requires a low-privilege authenticated session plus knowledge of a valid client_id, because ClientRepository.php's validateClient() returns true unconditionally and skips client_secret verification. Successful exploitation lets an attacker mint OAuth2 access tokens for any known client and impersonate it to read and modify data exposed through the API. A patched-image rebuild at FreePBX 17.0.8 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FreePBX api module over the network.

• AuthenticationRequired

  A low-privilege authenticated session plus knowledge of a valid client_id is required to request a token.

• Victim interactionNot required

  No user has to click or approve anything; the token endpoint is called directly.

• Attack complexityDetail

  AC:L indicates the exploit is reliable, though AT:P notes a passive precondition (knowing a valid client_id) outside the attacker's direct control.

Blast Radius

• Mints OAuth2 access tokens for any client whose client_id is known, without the client_secret.
• Reads data exposed through the FreePBX API under the impersonated client's scope, including call, extension, and configuration records.
• Modifies PBX configuration and records reachable through the same API scope, enabling tampering with routing, users, and integrations.