CVE-2026-75525

In OpenReception appointment booking software versions 2.1.0 and prior , an unauthenticated remote attacker can perform an ML-KEM key injection into the staff-crypto recipient directory of any tenant. By storing an arbitrary ML-KEM-768 public key under an existing user's identity, the attacker be...