Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-19677: onPhase Forms permits attackers admin login and command execution
CVE-2026-19677 · published 13 days ago
Summary
The onPhase Forms registration page (version 11.0.14) can be tricked into accepting forged registration data, letting anyone without credentials log in as any tenant user and gain admin or designer rights. Once logged in, the attacker can run any operating system command on the server. Apply the latest security update from the vendor and limit access to the registration endpoint until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| onphase | onphase forms | 11.0.14 |
Original advisory text
Authentication Bypass Leading to Server-Side Command Execution
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published23 Oct 2026
Updated5 Nov 2026
First seen23 Oct 2026
Track software like this
Free during beta