CVE-2025-55739: FreePBX API Authentication Bypass Vulnerability

CVE-2025-55739 Overview

CVE-2025-55739 affects the api module for FreePBX, an open source graphical interface that manages Asterisk-based PBX systems. The vulnerability stems from an identical OAuth private key distributed across every system that installed the same FreePBX RPM or DEB package. An attacker who obtains the shared key can forge JSON Web Tokens (JWTs), bypass authentication, and access both the REST and GraphQL APIs. Only systems with the api module enabled, configured, and previously activated by an administrator for remote inbound connections are exposed. The weakness is tracked under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
An attacker with the shared OAuth private key can forge valid JWTs and gain full programmatic access to FreePBX REST and GraphQL APIs without valid credentials.

Affected Products

FreePBX api module versions below 15.0.13
FreePBX api module versions 16.0.2 through 16.0.14
FreePBX api module versions 17.0.1 and 17.0.2

Discovery Timeline

2025-09-05 - CVE-2025-55739 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55739

Vulnerability Analysis

The FreePBX api module issues and validates JWTs for OAuth-based authentication to its REST and GraphQL endpoints. The signing material is an RSA private key generated during module installation. In the affected packages, the same private key material was bundled or deterministically produced across installations of the same RPM or DEB package. Any party in possession of that key can mint tokens accepted by any affected FreePBX deployment with the module activated for remote inbound connections. This converts a server-side signing secret into a universal forgery capability, equivalent to a hardcoded credential at the cryptographic layer.

Root Cause

The root cause is insufficient protection of the OAuth signing key. The api module stored the generated key with permissive file permissions, and the key material was not uniquely regenerated per deployment in a way that prevented cross-system reuse. Because JWT verification trusts any token signed with the corresponding private key, key uniqueness and strict filesystem permissions are prerequisites for sound authentication.

Attack Vector

An attacker with the shared private key crafts a JWT with arbitrary claims (user, scope, expiration) and submits it to the FreePBX API over the network. The server validates the signature against its local public key, which matches the shared private key, and treats the request as authenticated. Successful requests can enumerate configuration, modify dialplan or extension data, and interact with GraphQL mutations exposed by the module.

php

$this->freepbx->PKCS->generateKey($this->oauthKey);
$this->freepbx->PKCS->extractPublicKey($this->oauthKey);
if(isset($keyfile) && file_exists($keyfile)) {
+	chmod($keyfile, 0600);
+	chmod($pubkeyfile, 0600);
	$noKeyUpdateNotify = $this->getConfig('no-key-update-notifiy');
	if (!$noKeyUpdateNotify) {
		$nt = \notifications::create();

Source: FreePBX api commit 305295a — the patch restricts both the private and public key files to mode 0600 so only the owning service account can read them.

Detection Methods for CVE-2025-55739

Indicators of Compromise

Unexpected successful authentications to /admin/api/api/rest or GraphQL endpoints from unfamiliar source IP addresses.
JWTs presented to the FreePBX API with issuer, audience, or subject claims that do not match any provisioned local client.
Modifications to extensions, trunks, or dialplan configuration not correlated with an administrator session in the FreePBX UI.
Access attempts to API endpoints outside normal administrator working hours or from geographies not used by the organization.

Detection Strategies

Enable verbose logging on the FreePBX web server and parse access logs for Authorization: Bearer requests to API endpoints, correlating client identifiers against the configured application list.
Validate the kid, iss, and exp claims of inbound JWTs against the registered OAuth clients and alert on mismatches.
Compare the SHA-256 fingerprint of the installed /etc/asterisk/keys OAuth key against known shared-key fingerprints referenced in the FreePBX advisory.

Monitoring Recommendations

Forward FreePBX web and fail2ban logs to a central SIEM and alert on API authentication from any IP outside an allowlist.
Monitor the file permissions and inode changes on the OAuth key files to detect reversion to world-readable modes.
Track GraphQL mutation volumes and alert on anomalies relative to baseline administrator activity.

How to Mitigate CVE-2025-55739

Immediate Actions Required

Upgrade the api module to version 15.0.13, 16.0.15, or 17.0.3 as appropriate for the installed FreePBX major version.
Regenerate the OAuth signing key after upgrading and revoke all previously issued JWTs and OAuth client credentials.
Restrict network exposure of the FreePBX administrative and API interfaces to trusted management networks or VPN only.
Audit recent API access logs for forged-token activity dating back to the deployment of the affected module version.

Patch Information

The fix is delivered in api module versions 15.0.13, 16.0.15, and 17.0.3. The upstream commit 305295a enforces 0600 permissions on both the OAuth private and public key files. Additional context is provided in GitHub Security Advisory GHSA-3r47-p39v-vqqf. Operators should pair the module upgrade with a key rotation to invalidate any pre-existing shared-key material.

Workarounds

Disable the api module from the FreePBX Module Admin interface if remote API access is not required.
Block external access to the FreePBX API URIs at the perimeter firewall or reverse proxy until patching completes.
Manually tighten permissions on the OAuth key files to 0600 and change ownership to the Asterisk service account.

bash

# Tighten permissions on the FreePBX OAuth key material
chmod 0600 /etc/asterisk/keys/*.key
chmod 0600 /etc/asterisk/keys/*.pub
chown asterisk:asterisk /etc/asterisk/keys/*

# After upgrading, regenerate the OAuth key via the FreePBX CLI
fwconsole ma refreshsignatures
fwconsole reload