CVE-2026-73665

Received Received - Intake

Authentication Bypass in FreePBX UCP Node Server

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73665

Affected Vendors & Products

Vendor	Product	Version / Range
freepbx	freepbx	17.0.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

FreePBX versions before 17.0.9 have a vulnerability in the UCP Node server running on ports 8001 and 8003. The server uses Socket.IO version 4, which applies authentication middleware only to the default namespace. This allows unauthenticated users to connect to custom namespaces that bypass authentication checks. Attackers can then send crafted event values with carriage-return or newline characters through the Asterisk Manager Interface, enabling arbitrary command execution as the asterisk service user.

Detection Guidance

To detect this vulnerability, check if your FreePBX system is running a version prior to 17.0.9. Verify the UCP Node server ports 8001 and 8003 for unauthenticated connections to custom namespaces. Inspect logs for unusual commands or events containing carriage-return or newline characters via the Asterisk Manager Interface.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the system running FreePBX as the asterisk service user. This could lead to full system compromise, unauthorized access to sensitive data, or disruption of VoIP services. Attackers could install malware, steal data, or use the system for further attacks within the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected FreePBX versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized system access.

Mitigation Strategies

Upgrade FreePBX to version 17.0.9 or later to address the vulnerability. Ensure the UCP Node server is updated and restart services to apply fixes.

Hi! I’m here to help you understand CVE-2026-73665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70