What is CVE-2026-107638?

CVE-2026-107638 is a medium-severity vulnerability, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.8/10. Published 2026-10-08.

How severe is CVE-2026-107638?

Medium severity. CVSS v3 base score is 6.8 out of 10.

CVE-2026-107638

CVE-2026-107638

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.

Published 2026-10-08 · last modified 2026-10-08.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Weakness classification (CWE)

CWE-307 — Improper Restriction of Excessive Authentication Attempts

References

github.com/pH7Software/pH7-Social-Dating-CMS/commit/44970860b82f8af867de9d28320… (patch)
github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system… (technical-description)
github.com/pH7Software/pH7-Social-Dating-CMS (product)
www.vulncheck.com/advisories/ph7builder-before-18.5.0-2fa-brute-force-via-verif… (third-party-advisory)

Frequently asked questions

What is CVE-2026-107638?: CVE-2026-107638 is a medium-severity vulnerability, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.8/10. Published 2026-10-08.
How severe is CVE-2026-107638?: Medium severity. CVSS v3 base score is 6.8 out of 10.