Zero Radar
← feed
CriticalVulnerabilityCVE-2026-19677updated 25 Oct 2026, 17:05 UTC

frevvo onPhase registration form lets attackers bypass login in version 11.0.14

A flaw in a public sign-up form lets an outsider log in as an existing user, including someone with admin rights. From there, the attacker could run commands on the server itself.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or account needed
  2. 2Registration formParameters contain tenant and user ID
  3. 3Login bypassedAuthenticates as an existing user
  4. 4Admin privilegesGains TenantAdmin and Designer rights
  5. 5Command executionRuns arbitrary OS commands
  6. ResultAttacker controls the server

What happened

An authentication bypass in the public onPhase/ frevvo registration form, version 11.0.14, lets an unauthenticated remote attacker authenticate as an arbitrary tenant user by manipulating registration parameters that contain a valid tenant name and an existing user identifier.

Why it is dangerous: Successful exploitation grants TenantAdmin and Designer privileges and allows arbitrary operating system command execution, giving the attacker control over the affected server and tenant data.

Are you affected?

You are affected if you run frevvo onPhase version 11.0.14 with the public registration form exposed.

frevvo onPhase 11.0.14

What to do

  1. Check whether you run frevvo onPhase 11.0.14 and whether the public registration form is reachable from the internet
  2. Restrict or disable access to the onPhase/ registration form until a fix is confirmed
  3. Review tenant admin and designer accounts and recent registration activity for unexpected changes
  4. Apply the vendor's fixed release or official mitigation as soon as it is published

Timeline

  1. 23 Oct 2026, 02:16 UTC
    Publicly disclosed
  2. 23 Oct 2026, 02:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:05 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-19677 · GHSA-542f-hr4v-mv7f
CVSS
9.3 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 02:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

frevvo onPhase registration form lets attackers bypass login in version 11.0.14 · Zero Radar