{"id":"CVE-2026-65824","title":"OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie","summary":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-294"],"vendor":"open-reception","product":"appointment-booking-software","affected":["appointment-booking-software < 2.2.1"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T20:27:52.852Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65824","references":[{"url":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hvcx-8476-rwv6","label":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hvcx-8476-rwv6"},{"url":"https://github.com/open-reception/appointment-booking-software/commit/da921eb9d36953276577c0a6deb9267bfec03622","label":"https://github.com/open-reception/appointment-booking-software/commit/da921eb9d36953276577c0a6deb9267bfec03622"},{"url":"https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.1","label":"https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.1"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T21:38:13.060Z","slug":"CVE-2026-65824","body":"## Overview\n\nOpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.\n\n## Affected\n\n- `appointment-booking-software < 2.2.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}