pH7Software’s pH7Builder 18.2.0 utilizes the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers to resolve a client’s IP address. The header values are accepted without validating that the request originates from a trusted proxy, allowing an external attacker to alternate the X-Forwarded-For value on each request. Because the login‑attempt counter that protects the administrative interface is keyed on this IP, the counter never reaches the threshold needed to trigger a lockout, effectively removing IP‑based brute‑force protection. This flaw is a form of improper handling of client IP information that enables authentication bypass (CWE-290).

All pH7Builder installations released on or before 18.2.0 are affected. Any deployment running this or earlier versions without the fix is vulnerable to IP spoofing, enabling administrators to accelerate brute‑force login attempts from a single remote host without triggering throttling measures.

The vulnerability can be exploited by any entity capable of sending HTTP requests with custom X-Forwarded-For headers, requiring no prior authentication. The CVSS score of 6.5 categorises it as moderate. The EPSS score of less than 1% indicates a low overall probability of exploitation at this time, yet the simplicity of the attack path and moderate severity warrant immediate action. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack can be conducted over the public internet and that the likely attack vector is remote network access, assuming the web application is reachable from untrusted hosts.