CVE-2026-37604: pH7Builder Auth Bypass Vulnerability

CVE-2026-37604 Overview

pH7Software pH7Builder (pH7 Social Dating CMS) through version 18.2.0 contains a flaw in how it resolves client IP addresses. The application reads HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers in _protected/framework/Ip/Ip.class.php without validating that requests originate from a trusted proxy. The admin login lockout counter uses this attacker-controlled value as its key. A remote unauthenticated attacker can rotate the X-Forwarded-For header on each request and defeat brute-force throttling on the admin login endpoint.

Critical Impact
An unauthenticated remote attacker can bypass admin login rate limiting and brute-force administrator credentials against pH7Builder installations.

Affected Products

pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0
_protected/framework/Ip/Ip.class.php client IP resolution component
Installations exposed directly to untrusted networks without a validating reverse proxy

Discovery Timeline

2026-09-22 - CVE-2026-37604 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-37604

Vulnerability Analysis

The vulnerability is an HTTP request interpretation flaw classified under [CWE-444]. pH7Builder derives the client IP address from HTTP headers that are trivially forgeable by any remote caller. The Ip.class.php module prefers HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR over the transport-layer REMOTE_ADDR, but performs no check that these headers were set by a trusted upstream proxy.

The admin authentication component keys its failed-attempt counter and lockout state on the value returned by this IP resolver. Because the attacker controls the resolver's input, each request appears to originate from a different client. The lockout logic never triggers, and the brute-force protection is functionally absent.

Root Cause

The root cause is trust in unauthenticated client-supplied headers. Proxy-forwarded IP headers are only meaningful when the request path is known to traverse a trusted reverse proxy that overwrites them. pH7Builder accepts the headers unconditionally, allowing an attacker to spoof the perceived source address per request.

Attack Vector

An attacker sends repeated POST requests to the admin login endpoint and sets a fresh X-Forwarded-For value on each request. The lockout counter increments against a distinct pseudo-IP for every attempt and never reaches the threshold. This enables high-throughput credential guessing against administrator accounts. Successful authentication grants full administrative control of the CMS, including the database and site content.

No verified proof-of-concept code is published. See the Cybermap Group analysis for the disclosure writeup.

Detection Methods for CVE-2026-37604

Indicators of Compromise

High volumes of POST requests to admin login paths from a single REMOTE_ADDR while X-Forwarded-For values vary across requests
Rapid sequence of failed admin authentication events with no corresponding lockout triggered
Successful admin login immediately following a burst of failed attempts from the same TCP source

Detection Strategies

Correlate web server access logs on REMOTE_ADDR rather than X-Forwarded-For to reveal per-source request rates against admin endpoints
Alert when the ratio of unique X-Forwarded-For values to unique REMOTE_ADDR values on the admin login path exceeds a small threshold
Monitor the application audit trail for repeated failed logins without corresponding lockout state changes

Monitoring Recommendations

Ingest web and application logs into a centralized analytics platform and baseline normal admin login volume per source
Track authentication outcomes against the true transport-layer client address to detect distributed guessing that shares a single TCP origin
Alert on any successful admin login from a source that recently generated a burst of failures

How to Mitigate CVE-2026-37604

Immediate Actions Required

Restrict access to the admin login path by source IP allowlist at the web server or firewall
Enforce multi-factor authentication on all administrator accounts to blunt credential guessing
Reset administrator passwords and audit recent successful admin logins for unfamiliar sources

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the pH7 CMS GitHub repository and the pH7Builder official website for a fixed release.

Workarounds

Place pH7Builder behind a reverse proxy that overwrites X-Forwarded-For and Client-IP on ingress, and block these headers when set by external clients
Modify _protected/framework/Ip/Ip.class.php locally to return REMOTE_ADDR and ignore forwarded headers unless the upstream is in a trusted proxy list
Add a Web Application Firewall rule to rate-limit POST requests to the admin login endpoint on transport-layer source address

bash

# Nginx example: strip client-supplied forwarding headers at the edge
# and rate-limit the admin login endpoint on the real remote address
limit_req_zone $binary_remote_addr zone=ph7admin:10m rate=5r/m;

server {
    # Ignore attacker-supplied values; set only from the trusted proxy
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header Client-IP "";

    location ~* /admin.*login {
        limit_req zone=ph7admin burst=5 nodelay;
        proxy_pass http://ph7_backend;
    }
}