CVE-2026-108905 — pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks …
Published: 2026-10-11 · CVSS: 8.7 · CVSS 4.0
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7