CVE-2026-37604 pH7Software CVE debrief

Who should care

Defenders responsible for pH7Builder deployments should assess exposure and verify the use of trusted proxies to prevent IP-based throttling bypass. This includes reviewing the current configuration, ensuring that trusted proxies are properly set up, and monitoring for unusual activity that could indicate an attempted bypass.

Why it matters

CVE-2026-37604 allows a remote unauthenticated attacker to bypass IP-based throttling in pH7Builder, potentially leading to increased login attempts. Defenders should verify the use of trusted proxies and adjust configurations to prevent bypass. Remediation priority is high for deployments using IP-based throttling.

• An attacker can bypass IP-based throttling, potentially leading to increased login attempts
• Defenders need to verify the use of trusted proxies to prevent bypass
• Remediation priority is high for deployments using IP-based throttling

Technical summary

The pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 does not properly verify the client IP address, allowing a remote unauthenticated attacker to bypass IP-based throttling by sending a different X-Forwarded-For value per request. This is due to the client IP address being resolved from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verification of a trusted proxy, which can be exploited to increase login attempts. Defenders should prioritize verifying the use of trusted proxies and adjusting IP-based throttling configurations to prevent bypass.

Defensive priority

Defenders should prioritize verifying the use of trusted proxies and adjusting IP-based throttling configurations to prevent bypass.

Recommended defensive actions

• Verify the use of trusted proxies in pH7Builder deployments
• Adjust IP-based throttling configurations to prevent bypass
• Monitor for unusual login attempt patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional verification is needed to confirm affected versions and remediation. The vulnerability is based on the lack of verification of the client IP address from headers, which can be manipulated by an attacker. Defenders should verify the deployment's exposure and ensure proper configuration of trusted proxies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.