CVE-2026-107638
Last modified
CVE-2026-107638 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts..
Description
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-107638?
How severe is CVE-2026-107638?
How do I fix CVE-2026-107638?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107623A flaw was found in the OIDC Dynamic Client Registration (DC…4.3
- CVE-2026-10763PROMOD V is using insecure HTTP communication instead of HTT…7
- CVE-2026-107634Dislocker through 0.7.3 contains a heap out-of-bounds read v…6.1
- CVE-2026-107635Dislocker through 0.7.3 contains an integer underflow vulner…5.5
- CVE-2026-107636pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a …6.5
- CVE-2026-107637pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an…4.3
- CVE-2026-107639ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 co…8.8
- CVE-2026-10764Information disclosure in BVMS 4.5 up to 12.3 including allo…8.7
- CVE-2026-107640Integrics Enswitch 3.13 through 4.4 contains an authenticati…9.1
- CVE-2026-10766A vulnerability has been found in mlrun up to 1.12.0-rc3. Th…3.6
- CVE-2026-107660FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an imprope…4.8
- CVE-2026-107675FFmpeg through 9.0.2 contains a missing host key verificatio…5.9
Are you affected by CVE-2026-107638?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST