A newly disclosed flaw in onPhase's frevvo registration form (version 11.0.14) lets an unauthenticated attacker log in as any tenant's user simply by supplying a valid tenant name and an existing user ID. From there, the attacker can escalate to TenantAdmin and Designer-level access and ultimately run arbitrary operating system commands on the server. Tracked as CVE-2026-19677, the bug underscores the risk of trusting client-supplied identifiers during authentication flows.
// source: nvd.nist.gov ↗