# CVE-2026-37604: pH7Software pH7Builder IP spoofing authentication bypass

Source: https://junglewise.ai/threats/cve-2026-37604-ph7software-ph7builder-ph7-social-dating-cms-through-18-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-37604 · Severity: critical · CVSS 9.8 · Published 2026-09-22

pH7Builder is an open-source platform for building dating sites and social networks. The admin login protection uses rate-limiting based on the client IP address, but the application trusts untrusted HTTP headers to determine that IP. An attacker can bypass login attempt throttling by spoofing a different IP address on each password guess, enabling rapid credential guessing without triggering account lockouts.

Technologies: [pH7Software pH7Builder](https://junglewise.ai/threats/technologies/ph7builder). Vendors: [pH7Software](https://junglewise.ai/threats/vendors/ph7software).

## Quick answers

**Is CVE-2026-37604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37604 being exploited in the wild.

**How severe is CVE-2026-37604?** Critical severity, with a CVSS score of 9.8, published 22 September 2026.

**Which products and versions are affected?** pH7Software pH7Builder through 18.2.0.

**Is there a fix for CVE-2026-37604?** A patch was published on 2026-09-22: Fixed in version 18.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-37604 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-37604?** Check whether you run pH7Software pH7Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Ip.class.php, where the application resolves client IP from HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying these come from a trusted proxy. The admin login attempt counter and temporary lockout are keyed on this attacker-controlled IP value, allowing an unauthenticated remote attacker to reset rate-limit state per request by sending a different header value, bypassing all login throttling controls (CWE-290).

## Affected products

- pH7Software pH7Builder through 18.2.0

## Timeline

- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in version 18.3.0

## References

- [https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-ph7builder](https://cybermapgroup.com/en/blog/admin-brute-force-protection-bypass-chain-in-ph7builder)
- [https://github.com/pH7Software/pH7-Social-Dating-CMS](https://github.com/pH7Software/pH7-Social-Dating-CMS)

## Related threats

- [pH7Builder hard-coded API key in Tool.class.php](https://junglewise.ai/threats/cve-2026-108905-ph7builder-ph7-social-dating-cms-before-18-6-0-contains-a-hard)
- [pH7Builder information disclosure in API user endpoints](https://junglewise.ai/threats/cve-2026-108904-ph7builder-ph7-social-dating-cms-before-18-5-0-contains-an)
- [pH7Builder CAPTCHA bypass in form validation](https://junglewise.ai/threats/cve-2026-108903-ph7builder-ph7-social-dating-cms-before-19-3-0-contains-a)
- [pH7Builder path traversal in picture module deletePhoto()](https://junglewise.ai/threats/cve-2026-108902-ph7builder-ph7-social-dating-cms-before-18-5-0-contains-a-path)
- [pH7Software pH7Builder authentication bypass in admin login](https://junglewise.ai/threats/cve-2026-37603-improper-restriction-of-excessive-authentication-attempts-in-the)