CVE-2026-19677
Authentication Bypass Leading to Server-Side Command Execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
| CWE | CWE-306 |
| Vendor | onphase |
| Product | onphase forms |
| Published | Oct 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for onphase onphase forms
Be the first to know when new unknown vulnerabilities affecting onphase onphase forms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
onPhase / onPhase Forms
11.0.14
References
Credits
an1msh Crelic dwbzn