PT-2026-44842 · Freepbx · Freepbx

Mil1200 · CVE-2026-44237 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 17.0.8

Description The OAuth2 implementation in the api module fails to properly validate client credentials during token issuance. Specifically, the validateClient() function in ClientRepository.php unconditionally returns true. This allows an attacker who knows a valid client id to obtain OAuth2 access tokens without providing the required client secret.

Recommendations Update to version 17.0.8.

Exploit

Fix

Weakness Enumeration

CWE-1390

Related Identifiers

CVE-2026-44237

GHSA-VGJF-4H63-8VCC

Affected Products

Freepbx

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44237.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vgjf-4h63-8vcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44237 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44237 · Vendor Advisory
• https://t.me/cveNotify/208783 · Telegram Post