CRITICAL 9.3 NVD

CVE-2026-19677

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate

An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

References

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-23 via NVD.

Risk Timeline

CVE Disclosed2026-10-23 · -1 days ago

Remediation Resources

Official Advisory

frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detai

Analysis & PoC

frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=10

vulnfeed aggregates 17201 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.