FreePBX security advisory (AV25–831)

Serial number: AV25-831
Date: December 12, 2025

On December 9, 2025, FreePBX published a security advisory to address a critical vulnerability in the following products:

• FreePBX Security-Reporting framework (FreePBX 16/17) – versions 16.0.44 and prior
• FreePBX Security-Reporting framework (FreePBX 16/17) – versions 17.0.23 and prior

The Cyber Centre encourages users and administrators to review the web link provided, apply the necessary updates and perform the suggested mitigations.

• Authenticated Activation of Webserver Authentication Method in Advanced Settings Allows Subsequent Unauthenticated Logins