CVE-2026-108905: pH7Builder Auth Bypass Vulnerability

CVE-2026-108905 Overview

CVE-2026-108905 is a hard-coded credentials vulnerability [CWE-798] affecting pH7Builder (pH7 Social Dating CMS) versions before 18.6.0. The flaw resides in Tool.class.php within the API framework. Unauthenticated remote attackers can bypass API access checks by spoofing the HTTP Host header to localhost and supplying the embedded private API key dev772277 with the default allowed URL. Successful exploitation exposes sensitive member data including email addresses, IP addresses, phone numbers, and bank account fields.

Critical Impact

Unauthenticated attackers can exfiltrate personally identifiable information (PII) and financial data from affected pH7Builder deployments by sending a single crafted HTTP request.

Affected Products

• pH7Builder (pH7 Social Dating CMS) versions prior to 18.6.0
• Confirmed vulnerable source: _protected/framework/Api/Tool.class.php in tag v18.5.1
• Deployments exposing the API endpoint over the network

Discovery Timeline

• 2026-10-11 - CVE-2026-108905 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108905

Vulnerability Analysis

The vulnerability stems from an API authorization check that trusts two attacker-controllable inputs: the HTTP Host header and a client-supplied private_api_key parameter. The Tool.class.php component in the pH7 API framework compares the request's host against a localhost allowlist and compares the supplied key against the hard-coded value dev772277. Both checks can be satisfied by any remote client by setting Host: localhost and private_api_key=dev772277 in the request.

Once the checks pass, the API returns member records that include email addresses, source IP addresses, phone numbers, and bank account fields. The exposure constitutes a direct breach of PII and financial identifiers for every member stored in the application database.

Root Cause

Two defects combine to produce the bypass. First, a static developer key (dev772277) is embedded in source code and treated as an authorization token [CWE-798]. Second, the host validation relies on the untrusted Host request header rather than the server-observed connection address. Together they allow authentication to be forged entirely from the client side.

Attack Vector

The attack is network-reachable, requires no authentication, and no user interaction. An attacker sends an HTTP request to the vulnerable API endpoint with a spoofed Host: localhost header and appends private_api_key=dev772277 alongside the default allowed URL parameter. The server returns member data in the response body.

// Vulnerable logic pattern in _protected/framework/Api/Tool.class.php (v18.5.1)
// Reference: https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48
// The check trusts the client-supplied Host header and a hard-coded key.
// Example malicious request:
//   GET /api/?url=<default_allowed_url>&private_api_key=dev772277 HTTP/1.1
//   Host: localhost

Source: GitHub Source Code Segment

Detection Methods for CVE-2026-108905

Indicators of Compromise

• HTTP requests to pH7Builder API endpoints containing the parameter private_api_key=dev772277
• Inbound requests whose Host header is localhost or 127.0.0.1 but whose source IP is external
• Unexpected API responses containing bulk member records with email, phone, or bank account fields
• Access-log entries referencing /api/ paths from non-trusted source addresses

Detection Strategies

• Alert on any web request where the Host header does not match the server's expected public hostname or TLS SNI value
• Create web application firewall (WAF) rules that flag query strings containing the literal key dev772277
• Correlate API response sizes against baseline to detect bulk data exfiltration from pH7 endpoints

Monitoring Recommendations

• Ingest web server and reverse proxy access logs into a centralized analytics platform for pattern analysis
• Monitor outbound data volume from pH7Builder hosts for anomalous spikes indicating scraping
• Review authentication and API audit trails for repeated access to the same member records from unknown IP addresses

How to Mitigate CVE-2026-108905

Immediate Actions Required

• Upgrade pH7Builder to version 18.6.0 or later immediately
• Rotate any API keys and credentials that may have been exposed through the vulnerable endpoint
• Audit application and web server logs for prior exploitation attempts using dev772277 or spoofed Host headers
• Notify affected members if evidence of PII or financial data access is found

Patch Information

The vendor addressed the issue in commit cfe1e0c, included in pH7Builder 18.6.0. Additional background is published in the VulnCheck Security Advisory. The following patch excerpts illustrate the hardening applied to related core classes:

 <?php
+
 /**
  * @author         Pierre-Henry Soria <hello@ph7builder.com>
  * @copyright      (c) 2013-2023, Pierre-Henry Soria. All Rights Reserved.
  * @license        MIT License; See LICENSE.md and COPYRIGHT.md in the root directory.
- * @package        PH7 / App / System / Core / Class
  */

 namespace PH7;

Source: GitHub Commit cfe1e0c - WriteCore.php

 use PH7\Framework\File\File;
 use PH7\Framework\Mvc\Model\DbConfig;
 use PH7\Framework\Pattern\Statik;
+use PH7\Framework\Str\Str;
 use PH7\Framework\Video\Api as VideoApi;
 use PH7\Framework\Video\InvalidApiProviderException;
 use stdClass;

Source: GitHub Commit cfe1e0c - VideoDesignCore.php

Workarounds

• Block access to /api/ endpoints at the reverse proxy or WAF layer until the upgrade is applied
• Add a WAF rule that drops any inbound request whose Host header equals localhost or 127.0.0.1
• Add a WAF rule that drops requests containing the string dev772277 in the query string or body
• Restrict API endpoint access to known administrative source IP ranges using network ACLs

# Example NGINX rule to reject spoofed Host headers reaching the pH7 API
location /api/ {
    if ($http_host ~* "^(localhost|127\.0\.0\.1)$") {
        return 403;
    }
    if ($args ~* "private_api_key=dev772277") {
        return 403;
    }
    proxy_pass http://ph7_backend;
}