[ CVE-2026-19677 · Published 23 Oct 2026 ]
Vulnerability in onPhase Forms
CVSS 9.3
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.3
[ Description ]Official description
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.