The vulnerability in FreePBX's api module (before version 17.0.8) involves weak authentication in the OAuth2 token issuance process. The validateClient() method fails to properly verify client credentials, unconditionally returning true. As a result, an attacker who knows a valid client_id can obtain OAuth2 access tokens without providing the corresponding client_secret. This flaw compromises the authentication mechanism, potentially allowing unauthorized access to the system. The vulnerability is tracked as CVE-2026-44237 and is addressed in FreePBX version 17.0.8.

An attacker with knowledge of a valid client_id can bypass client_secret verification and obtain OAuth2 access tokens, potentially gaining unauthorized access to FreePBX resources protected by OAuth2 authentication. This could lead to unauthorized actions within the affected system. The CVSS 4.0 score of 7.6 (high severity) reflects the network attack vector, low attack complexity, and high impact on confidentiality and integrity.

Upgrade FreePBX to version 17.0.8 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor advisory stating the issue is fixed in 17.0.8.