pH7Builder: Hard-coded API key bypass via Host header
Summary
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key in Tool.class.php. An unauthenticated remote attacker can send a spoofed Host header of localhost together with the default key and an allowed URL to bypass the API access check. A successful attacker can retrieve member email addresses, IP addresses, phone numbers and bank account fields. The CVSS 8.7 score comes from the CNA record because NVD analysis is deferred.
Affected
- pH7Builder versions before 18.6.0 (CNA record: 0 to < 18.6.0)
Fixed in
- Upgrade to pH7Builder 18.6.0 or later. The 18.6.0 release could not be independently verified; check the vendor's GitHub releases.
Workaround
- Unknown. The vendor has published no workaround.
- Interim measures (not from the vendor): restrict the API endpoints at the reverse proxy or WAF to known consumer IP addresses, and reject requests whose Host header does not match the site's own domain.
Exploitation
- No known exploitation in the wild in the current sources.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No separate public proof of concept found; the public description is detailed enough that exploitation is low-effort.
Our recommendation
- Identify all pH7Builder instances, including those installed through hosting one-click installers, and record their versions.
- Upgrade affected instances to 18.6.0 or later.
- Until the upgrade is done, restrict API endpoints to known IP addresses and block mismatched Host headers.
- Review logs for API requests with Host: localhost and the key dev772277.
- If member or bank data may have been exposed, involve legal counsel to assess breach notification duties under the revised Swiss FADP.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulnCheck advisory) www.vulncheck.com
- VulDB CVE-2026-108905 vuldb.com
- VulDB vulnerability 416717 vuldb.com
- Vulnerable code Tool.class.php (v18.5.1) github.com
- Fix commit cfe1e0c4 github.com
- pH7Builder GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:01.
Original description (NVD)
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
NVD references (4)
- https://github.com/pH7Software/pH7-Social-Dating-CMS
- https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25…
- https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2
- https://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.