CVE-2026-75524

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping...

CVE-2026-75525

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. Th...

CVE-2026-65824

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-58202

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a...

CVE-2026-65825

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-75525

In OpenReception appointment booking software versions 2.1.0 and prior , an unauthenticated remote attacker can perform an ML-KEM key injection into the staff-crypto recipient directory of any tenant. By storing an arbitrary ML-KEM-768 public key under an existing user's identity, the attacker be...

CVE-2026-75525 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. Th...

CVE-2026-75524

The OpenReception appointment booking software (versions prior to 2.2.2 ) is vulnerable to a race condition (CWE-367) in its add-to-tunnel and create-new-client functions. An attacker can exploit this to overbook an agent by placing multiple appointments into a single time slot that should remain...

CVE-2026-75524 OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping...

CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, grantin...

CVE-2026-65825

OpenReception's appointment booking software (versions 2.1.0 and prior ) is vulnerable to a cross-tenant authentication bypass. A state owned by one tenant can disable the PIN brute-force throttle for the same identifier in other tenants, allowing an attacker to perform an online brute-force atta...

CVE-2026-65824

OpenReception's appointment booking software (prior to version 2.2.1 ) is vulnerable to a replay attack involving invite confirmation tokens. An attacker capturing a pending token can replay it to obtain a passkey-registration credential, allowing them to register their own passkey and take contr...

CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taki...

CVE-2026-58202

OpenReception's appointment booking software is vulnerable to a pending account takeover prior to version 2.0.0 . The unauthenticated POST /api/auth/resend-confirmation endpoint constructs confirmation email links using the request Host header without an allowlist. An attacker can provide a malic...

CVE-2026-58202 OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a...

CVE-2026-54460

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-54460

OpenReception appointment booking software (prior to 1.1.1 ) is vulnerable to unauthenticated account takeover via the POST /api/auth/passkeys endpoint. The endpoint accepts an attacker-supplied userId and passkey without an authenticated session, fails to call WebAuthnService.verifyRegistration,...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...