CVE-2026-108905 in pH7Builder
Summary
by MITRE • 10/11/2026
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in pH7Builder prior to version 18.6.0 represents a critical failure in authentication logic stemming from hardcoded credentials within the application's source code. Specifically, the flaw resides in Tool.class.php, where an API key is statically defined rather than being dynamically generated or securely stored. This architectural decision creates a persistent backdoor that remains present across all installations of affected versions, regardless of how the administrator configures security settings during deployment. The presence of this hard-coded secret allows any external actor to authenticate as a privileged user without possessing valid credentials issued by the specific instance owner.
The technical mechanism exploited involves manipulating HTTP headers and query parameters to bypass access control checks. An unauthenticated attacker can craft requests that include a spoofed Host header set to localhost, which often implies local or trusted origin in poorly configured security policies. By simultaneously providing the hardcoded private API key dev772277 along with default allowed URLs, the application incorrectly validates the request as legitimate. This bypasses standard authentication middleware because the system trusts the static credential over dynamic session validation or token-based verification mechanisms typically required for sensitive operations.
The operational impact of this vulnerability is severe due to the sensitivity of data accessible through these endpoints. Once authenticated via the hardcoded key, attackers can retrieve personally identifiable information including member email addresses, IP addresses, phone numbers, and even bank account details. This exposure facilitates a wide range of downstream attacks such as phishing campaigns using real user contact information, identity theft involving financial data, or further network reconnaissance based on collected IP addresses. The leakage of banking information poses direct financial risk to users and significant liability for the platform operators due to non-compliance with privacy regulations like GDPR or CCPA.
From a classification perspective, this issue aligns with CWE-798: Use of Hard-coded Credentials, which highlights the danger of embedding secrets directly in source code. It also relates to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-345: Insufficient Verification of Data Authenticity regarding the host header spoofing aspect. In terms of attack vectors, this falls under ATT&CK technique T1190: Exploit Public-Facing Application, as it leverages a flaw in internet-facing software components to gain unauthorized access without prior authentication.
Mitigation strategies must prioritize immediate remediation by upgrading pH7Builder to version 18.6.0 or later where this hardcoded key has been removed and replaced with secure dynamic generation methods. For systems that cannot be immediately upgraded, administrators should implement web application firewall rules to block requests containing the specific API value dev772277 in query parameters or headers. Additionally, enforcing strict validation of the Host header against a whitelist of allowed domains can prevent spoofing attacks. Long-term security hygiene requires auditing all third-party components for hardcoded secrets and ensuring that sensitive data such as bank details are encrypted at rest and not exposed through unauthenticated API endpoints.