CVE-2026-108905: pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
pH7Builder installations before 18.6.0 are affected. The described attack uses the default allowed URL and a hard-coded API key, so deployments retaining those defaults are exposed.
What does an attacker need to exploit this issue?
No authentication, prior privileges, or user interaction is required. An attacker needs to send an API request with a spoofed Host header of localhost and private_api_key=dev772277.
What data can be accessed through the bypass?
The bypass can allow retrieval of member email addresses, IP addresses, phone numbers, and bank account fields.
How can I identify attempted exploitation in request logs?
Look for API requests containing a Host header set to localhost together with the private_api_key parameter set to dev772277.