CVE-2026-37603: pH7Builder Authentication Bypass Vulnerability

CVE-2026-37603 Overview

CVE-2026-37603 is an authentication brute-force protection bypass in pH7Software pH7Builder (pH7 Social Dating CMS) through version 19.2.0. The administration login relies on a CAPTCHA escalation flag stored in the PHP session as captcha_admin_enabled. The CAPTCHA form element is only rendered when that session flag is present. A remote unauthenticated attacker who requests a new session before each login attempt never receives the challenge. This effectively neutralizes the brute-force protection on the admin panel and enables automated credential guessing. The weakness is tracked as [CWE-307: Improper Restriction of Excessive Authentication Attempts].

Critical Impact
Unauthenticated attackers can bypass CAPTCHA-based brute-force protection on the pH7Builder admin login by rotating PHP sessions between attempts.

Affected Products

pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0
Administration login component of pH7Builder
Deployments relying on the built-in CAPTCHA escalation for admin brute-force defense

Discovery Timeline

2026-09-22 - CVE-2026-37603 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-37603

Vulnerability Analysis

The pH7Builder admin login implements adaptive CAPTCHA protection intended to slow down automated credential-guessing attacks. The escalation state is stored server-side as a PHP session variable named captcha_admin_enabled. The login form template only builds the CAPTCHA element when the flag is present in the current session.

Because the escalation flag lives inside a single session rather than being tied to the source IP address, username, or a persistent store, an attacker who discards the session cookie before each request always operates against a fresh session that has never observed a failed attempt. The CAPTCHA is therefore never emitted, and the login handler accepts credential submissions without a challenge.

The result is an authentication brute-force protection bypass. Attackers can iterate through large credential lists against the administrative endpoint without triggering the intended rate-limiting user interface. Successful guessing yields administrative access to the CMS.

Root Cause

The root cause is state binding to the wrong scope. The CAPTCHA escalation counter and flag are stored per-PHP-session rather than per-identity (username) or per-source (IP address, network range). Session identifiers are attacker-controlled inputs, so any control gated on session state alone is trivially reset.

Attack Vector

Exploitation requires only network access to the admin login endpoint. The attacker automates login POST requests, discarding the PHPSESSID cookie between attempts and allowing the server to issue a new session for each request. Each new session lacks the captcha_admin_enabled flag, so no CAPTCHA is rendered or required. Credential guessing then proceeds at the maximum rate the network and server can sustain.

See the CyberMap Group technical write-up for the full exploitation chain and the pH7 CMS repository for source context.

Detection Methods for CVE-2026-37603

Indicators of Compromise

Repeated POST requests to the pH7Builder admin login URL where each request presents a new or missing PHPSESSID cookie.
High volumes of failed admin authentication events from a small set of source IP addresses or a single automation user agent.
Successful admin logins immediately preceded by dozens or hundreds of failed attempts within a short time window.

Detection Strategies

Alert on admin login attempts that never carry a returning session cookie, indicating cookie-jar rotation.
Correlate failed admin login counts by source IP and username over sliding time windows independent of session state.
Flag admin login requests where the response HTML lacks a CAPTCHA element despite prior failures from the same source.

Monitoring Recommendations

Ingest pH7Builder web server access logs and admin authentication logs into a centralized analytics platform for rate and pattern analysis.
Track the ratio of unique session identifiers to login POSTs per source IP; a near 1:1 ratio suggests session rotation.
Monitor administrative accounts for anomalous successful logins outside normal hours or from new geolocations.

How to Mitigate CVE-2026-37603

Immediate Actions Required

Restrict access to the pH7Builder administration login to trusted IP ranges via web server or firewall access control lists.
Enforce IP-based and username-based rate limiting at a reverse proxy or web application firewall (WAF) in front of pH7Builder.
Rotate all administrator credentials and require strong, unique passphrases combined with multi-factor authentication where supported.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-37603 at time of publication. Monitor the pH7Software pH7Builder GitHub repository and the pH7Builder official website for a fixed release beyond version 19.2.0. Any durable fix must bind brute-force state to identity or source rather than to the PHP session.

Workarounds

Place the admin login behind an authenticating reverse proxy (mTLS, VPN, or HTTP basic auth) so unauthenticated requests never reach the vulnerable endpoint.
Configure the WAF to block admin login POSTs that arrive without a valid, previously issued PHPSESSID cookie.
Implement fail2ban or equivalent log-driven blocking on repeated failed admin logins by source IP.

bash

# Example nginx rate limit for the pH7Builder admin login
limit_req_zone $binary_remote_addr zone=ph7admin:10m rate=5r/m;

location /asset/ajax/admin/ {
    limit_req zone=ph7admin burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://ph7_backend;
}