CVE-2026-107638 — pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authenticat…
Published: 2026-10-08 · CVSS: 7.6 · CVSS 4.0
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7