CVE-2026-19677
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version…
- Risk score
- 70/100
- CVSS
- 9.3 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user and execute arbitrary operating system commands.
- Affected
- {'products': ['frevvo'], 'packages': [], 'versions': ['11.0.14']}
- Fix
- Check the linked advisory for a fix, as none is specified
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.3 critical
- Remotely exploitable without logging in
References
Original description
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Last activity 23 Oct 2026. Patch Forecast updates every hour.