CVE-2026-58202

OpenReception's appointment booking software is vulnerable to a pending account takeover prior to version 2.0.0 . The unauthenticated POST /api/auth/resend-confirmation endpoint constructs confirmation email links using the request Host header without an allowlist. An attacker can provide a malic...