# CVE-2026-19677: Authentication Bypass Leading to Server-Side Command Execution

Status: published. Published: 2026-10-23. Updated: 2026-11-02.

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

## Remediation

- fix: *  Upgrade to 11.0.17

 
    *  The
      unauthenticated registration endpoint has been removed.

    *  Rules run in a
      sandbox that blocks access to unapproved Java classes.

    *  The Document
      Service endpoint (/service) is disabled by default
      (frevvo.documentServiceApi.enabled=false). Re-enabling it brings back the
      risk of server-side request forgery and is done at the customer's own
      risk.

 


   *  Customers who
     cannot upgrade immediately should block /frevvo/web/webapp/register and
     /frevvo/web/**/service at their reverse proxy or web application firewall. (source: CNA: MON-CSIRT)

## Affected products and versions

- onPhase / onPhase Forms: 11.0.14 (affected). Source: CNA: MON-CSIRT

## Severity and prioritization

- CVSS 4.0: 9.3 (critical); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: MON-CSIRT

- CISA KEV: No listing in collected sources

- EPSS: 0.53% as of 2026-11-01; percentile 45.06%

- SSVC: exploitation none; automatable yes; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-306

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes (CNA: MON-CSIRT; release-notes)

- https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609 (CNA: MON-CSIRT; product)

## Provenance

- CNA: MON-CSIRT: https://www.cve.org/CVERecord?id=CVE-2026-19677; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-19677; retrieved 2026-11-02; source updated Not reported

Revision: 857fa549ba091fb53eedba7dba1c82a7db6867a6b835dd320c29972e3a291634

Canonical: https://y2.dev/cve/CVE-2026-19677