Vulnerability · Published Oct 23, 2026 · Assigned by MON-CSIRT

CVE-2026-19677Authentication Bypass Leading to Server-Side Command Execution

Critical 9.3

In plain English

A critical-severity missing authentication in onPhase Forms from onPhase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

Affected products (as reported)

Vendor	Product	Versions
onPhase	onPhase Forms	11.0.14

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References