onPhase Forms: Authentication bypass leading to OS command execution
Summary
onPhase Forms version 11.0.14 contains an authentication bypass in the public registration form (onPhase/ path). An unauthenticated remote attacker can register using a valid tenant name and an existing user identifier, log in as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands on the server. Only network access to the registration form is required; no user interaction is needed.
Affected
- onPhase Forms 11.0.14 (CNA record; the default configuration is listed as unaffected)
- Earlier versions are not listed as affected, but this is not independently confirmed.
Fixed in
- Upgrade to 11.0.17 (CNA record).
- Some sources cite 11.0.15 instead. Check the vendor release notes for the first fixed build before patching decisions.
Workaround
- Block /frevvo/web/webapp/register and /frevvo/web/**/service at the reverse proxy or WAF until the upgrade is done (CNA record).
- Keep the Document Service endpoint disabled (frevvo.documentServiceApi.enabled=false); re-enabling it carries server-side request forgery risk.
- Restrict public access to the registration form if the business does not need it.
Exploitation
- No exploitation in the wild known; not listed as KEV in one tracker.
- No public proof-of-concept found; VulDB states there is no available exploit.
- EPSS score is low (0.00533 in one aggregator).
- NVD status was still Awaiting Analysis at the time of research.
Our recommendation
- Inventory all onPhase Forms / frevvo instances and confirm the exact version.
- If an instance on 11.0.14 is reachable from the internet, block the public registration path immediately.
- Upgrade to 11.0.17, or to the fixed build confirmed in the vendor release notes.
- Review logs for requests to the registration path, unknown tenant users, admin accounts, and unexpected server processes.
- If the product is absent or not on 11.0.14, no action beyond normal monitoring is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- onPhase Forms v11.0 Documentation frevvo-docs.atlassian.net
- onPhase Forms v11.0 Detailed Release Notes frevvo-docs.atlassian.net
- Vulners CVE-2026-19677 vulners.com
- VulDB CVE-2026-19677 vuldb.com
- VulDB vulnerability 425553 vuldb.com
- Strix CVE-2026-19677 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:51.
Original description (NVD)
An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.