Authentication Bypass in onPhase/frevvo Registration Form Affects Version 11.0.14
CVE-2026-19677

9.3CRITICAL

Key Information:

Vendor

Onphase

Status
Onphase Forms
Vendor
CVE Published:
23 October 2026

What is CVE-2026-19677?

An authentication bypass vulnerability exists in the onPhase/frevvo registration form version 11.0.14. This flaw allows an unauthenticated remote attacker to gain unauthorized access as any tenant user by exploiting the registration parameters. By providing a valid tenant name and an existing user identifier, attackers can escalate their privileges to TenantAdmin and Designer levels. Consequently, this grants them the ability to execute arbitrary commands on the operating system, posing significant risks to system integrity and data security.

Affected Version(s)

onPhase Forms 11.0.14

References

https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/p...
release-notes
https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/o...
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

an1msh
Crelic
dwbzn
.