Read the docs
TI-2025-35159 Aliases CVE-2025-55739

api: Shared OAuth Signing Key Between Different Instances

Priority LOW 24CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522 and CWE-798.

Summary

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An attacker with access to the shared OAuth private key could forge JWT tokens, bypass authentication, and potentially gain full access to both REST and GraphQL APIs. Systems with the "api" module enabled, configured and previously activated by an administrator for remote inbound connections may be affected. This issue is fixed in versions 15.0.13, 16.0.15 and 17.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed api (FreePBX): 15.0.13, 16.0.15, 17.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreePBXapibefore 15.0.13; 16.0.2 to before 16.0.15; 17.0.1 to before 17.0.315.0.13, 16.0.15, 17.0.3Patch availableCNA
  • api VendorFreePBX Affected before 15.0.13; 16.0.2 to before 16.0.15; 17.0.1 to before 17.0.3 Fixed in 15.0.13, 16.0.15, 17.0.3 Patch available CNA

Remediation

  • Fix · CNA api (FreePBX) Fixed in 15.0.13, 16.0.15, 17.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55739

References

Other 2

  • TI-2025-35702 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE KEVCVSS 4.0CRITICAL 10.0
  • TI-2025-39763 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection KEVCVSS 4.0HIGH 8.6
  • TI-2024-38391 FreePBX 16 Authenticated Remote Code Execution via API Module CVSS 4.0HIGH 8.7
  • TI-2014-06023 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface… CVSS 2.0HIGH 10.0
  • TI-2025-36981 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page CVSS 4.0HIGH 8.5
  • TI-2025-38110 FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter CVSS 4.0HIGH 8.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences