CVE-2026-19677
Authentication Bypass Leading to Server-Side Command Execution
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 23, 2026
- Updated
- Oct 23, 2026
- Reserved
- Aug 12, 2026
Description
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | MON-CSIRT |
Weaknesses
- CWE-306 Missing authentication for critical function
Affected Products
| Product | Versions |
|---|---|
onPhase FormsonPhase |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.