CVE-2026-107638: Improper Restriction of Excessive Authentication Attempts in ph7software ph7builder

CVE-2026-107638 describes an improper restriction of excessive authentication attempts vulnerability in pH7Builder (pH7 Social Dating CMS) versions prior to 18.5.0. The flaw allows attackers who have valid account passwords to bypass two-factor authentication by guessing Time-based One-Time Password (TOTP) codes without any rate limiting. Attackers can submit unlimited 6-digit verification codes to the VerificationCodeFormProcess.php endpoint, enabling account takeover of various user roles including members, affiliates, and administrators.

Successful exploitation allows attackers to bypass two-factor authentication protections by brute forcing TOTP codes without restriction, leading to unauthorized account takeover. This affects all user roles, including privileged administrator accounts, thereby compromising the confidentiality and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to monitor for updates from the vendor and apply any official patches once released. Implementing additional rate limiting or blocking mechanisms on the verification code submission endpoint may reduce risk temporarily.