CVE-2025-55210

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerable to privilege escalation by authenticated users with REST/GraphQL API access. This vulnerability allows an attacker to forge a valid JWT with full access to the REST and GraphQL APIs on a FreePBX that they've already connected to, possibly as a lower privileged user. The JWT is signed using the api-oauth.key private key. An attacker can generate their own token if they possess this key (e.g., by accessing an affected instance), and specify any scopes they wish (e.g., rest, gql), bypassing traditional authorization checks. However, FreePBX enforces that the jti (JWT ID) claim must exist in the database (api_access_tokens table in the asterisk MySQL database) in order for the token to be accepted. Therefore, the attacker must know a jti value that already exists on the target instance. This vulnerability is fixed in 17.0.5 and 16.0.17.

• CWE-270

• https://github.com/FreePBX/api/commit/bc6f7d72063cffb18babb6559fa351046d7ad19bPatch
• https://github.com/FreePBX/api/commit/c16a3a79b83382fb4884e51174882ed635637002Patch
• https://github.com/FreePBX/api/commit/d66786634e7e7d3eedcb4d0931b32c415ba6e9efPatch
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-gvgh-p7wj-76cfVendor Advisory

Published

Feb 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55204muffon is a cross-platform music streaming client for deskto…9.6
• CVE-2025-55205Capsule is a multi-tenancy and policy-based framework for Ku…9
• CVE-2025-55207Astro is a web framework for content-driven websites. Follow…5.5
• CVE-2025-55208Chamilo is a learning management system. Versions prior to 1…9
• CVE-2025-55209contactmanager is a module for FreePBX@, which is an open so…5.1
• CVE-2025-5521A vulnerability was found in WuKongOpenSource WukongCRM 9.0.…8.8
• CVE-2025-55211FreePBX is an open-source web-based graphical user interface…8.8
• CVE-2025-55212ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-55213OpenFGA is a high-performance and flexible authorization/per…9.8
• CVE-2025-55214Copier library and CLI app for rendering project templates. …6.9
• CVE-2025-5522A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up t…7.3
• CVE-2025-55221A denial of service vulnerability exists in the Modbus TCP a…7.5