CVE-2026-65824High· 7.4▾ TwilightOpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
appointment-booking-software < 2.2.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58202High· 8.3OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`
CVE-2026-65825High· 7.5OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants
CVE-2026-75524Medium· 5.4OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
CVE-2026-75525Medium· 5.3OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
CVE-2026-54460Critical· 9.8OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
CVE-2026-114617Medium· 4.2Authlib: ID token can disable its own nonce validation via the nonce_supported claim