CVE-2026-44237

Summary: CVE-2026-44237 affects FreePBX before 17.0.8. The api module’s OAuth2 flow does not validate client credentials during token issuance; validateClient() in ClientRepository.php unconditionally returns true. This allows any party with a valid client_id to obtain OAuth2 access tokens withou...

PT-2026-44842

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 17.0.8 Description The OAuth2 implementation in the api module fails to properly validate client credentials during token issuance. Specifically, the validateClient function in ClientRepository.php unconditionally...

CVE-2009-5144

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate...