by Kastro
Paper/Archive/CVE-2026-19677

CVE-2026-19677

onPhase onPhase Forms — Authentication Bypass Leading to Server-Side Command Execution

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 45.0.450 × 209.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

Affected

ProductAffectedFixed inSource
onPhase Forms11.0.14–CNA

Scores by source

MON-CSIRT (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

reffrevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notesreffrevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609