Threats tagged 'ghsa-3m9j-mmxr-3x76'

pH7Builder versions before 18.5.0 have an information disclosure vulnerability where API endpoints return unfiltered user data. Attackers with a valid private API key can access sensitive information including bcrypt password hashes, non-expiring reset tokens, and TOTP secrets, enabling account takeover and bypass of two-factor authentication.