I am just wondering how is this really exploitable? I know that
unserialize() can be used to perform object injection. But how can it be used to exploit this vulnerability be used to bypass authentication?
unserialize allows the creation of arbitrary object constructs of any class with arbitrary attributes. During deserialization, the lifetime of an object, and the interaction with the object, several methods including magic methods may get called using these arbitrarily definable attributes. An attacker may be able to utilize the functionality provided within these called methods for his benefit.
In the end, the exploitability of such a vulnerability solely depends on the available classes and their functionalities. Have a look at the Observed Examples and References section of CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes for examples and further information.
And since the mentioned vulnerability in FreePBX is accessible without authentication (it actually happens during the authentication process), one may say that it bypass authentication.