The vulnerability arises because FreePBX’s API module fails to validate client secrets when issuing OAuth2 tokens. As a result, any party that knows a valid client_id can request and receive a bearer token without providing the matching client_secret. This flaw allows attackers to obtain access tokens that grant the same privileges as the legitimate client, potentially enabling full API exploitation and the execution of privileged actions.

FreePBX, the open source IP PBX platform, is affected. The flaw exists in the API module service in versions earlier than 17.0.8. Users running any FreePBX release prior to 17.0.8 are vulnerable unless mitigated by configuration changes.

The vulnerability carries a CVSS score of 7.6, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. An attacker would need to obtain or discover a valid client_id, a piece of information that might be exposed through configuration files or network reconnaissance. Once the client_id is known, the attacker can directly request OAuth2 tokens from the API, bypassing the client_secret check, and immediately gain authenticated access to the API.