CVE-2024-58405

Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers...

EUVD-2024-55849

Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers...

CVE-2024-58405

Zipline through version 3.7.9 is affected by an improper authorization vulnerability in the /api/auth/register endpoint. The flaw occurs because the system only enforces invite codes when user registration is disabled; if both features are enabled, registration succeeds without a required invite....

CVE-2024-58405 Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint

Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers...

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at "POST /api/auth/register/userId" validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

PT-2026-68749

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description The registration handler at the endpoint POST /api/auth/register/userId fails to validate that the userId provided in the URL corresponds to the email address associated with the registration...

CVE-2026-48087: Improper Authentication

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...