CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
Unauthenticated attackers can bypass API checks using a hard-coded key and spoofed Host header to access sensitive member data in pH7Builder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108905?
CVE-2026-108905 is a high-severity vulnerability in ph7software ph7builder, published on 11 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
Weakness: CWE-798
Which versions are affected by CVE-2026-108905?
How do I fix CVE-2026-108905?
No fix has been published for CVE-2026-108905 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108905 being exploited?
There is no known exploitation of CVE-2026-108905 in the wild and no public exploit code.
Sources
Also known as GHSA-jfr6-f5qc-qp53.