CVE-2026-19677: Authentication Bypass Leading to Server-Side Command Execution

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-23 · updated 2026-10-23
Weakness: CWE-306

Description

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

Affected products

onPhase Forms: 11.0.14

References

https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes

Get alerted when CVE-2026-19677 or the next vulnerability affects your stack