Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-37604: pH7Builder login throttling can be bypassed by spoofed IP
CVE-2026-37604 · published 1 month ago
Summary
The pH7Builder dating CMS (up to version 18.2.0) trusts the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers to identify a user’s IP address without checking if they come from a known proxy. Because the system uses that IP to count failed admin logins, an attacker can send a different X-Forwarded-For value each time and avoid lockout. Update to a patched version or configure the server to ignore those headers unless they are from trusted proxies.
Original advisory text
pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without...
pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request
References
- https://ph7builder.com URL
- https://github.com/pH7Software/pH7-Social-Dating-CMS Product
- https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-p... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37604... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-37604 Vendor Advisory
- https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-p... Exploit
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-290Authentication Bypass by Spoofing
Timeline
Published22 Sep 2026
Updated12 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta