---
id: CVE-2026-19677
title: Authentication Bypass Leading to Server-Side Command Execution
summary: "An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14\_allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and…"
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: onPhase
product: onPhase Forms
affected:
  - forms 11.0.14
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T01:21:08.272Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-19677'
references:
  - url: >-
      https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes
  - url: >-
      https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609
tags:
  - cve.org
ingestedAt: '2026-10-23T02:12:52.300Z'
---

## Overview

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

## Affected

- `forms 11.0.14`

## Remediation

*  Upgrade to 11.0.17

 
    *  The
      unauthenticated registration endpoint has been removed.

    *  Rules run in a
      sandbox that blocks access to unapproved Java classes.

    *  The Document
      Service endpoint (/service) is disabled by default
      (frevvo.documentServiceApi.enabled=false). Re-enabling it brings back the
      risk of server-side request forgery and is done at the customer's own
      risk.

 


   *  Customers who
     cannot upgrade immediately should block /frevvo/web/webapp/register and
     /frevvo/web/**/service at their reverse proxy or web application firewall.