CVE-2026-65824highCWE-294

CVE-2026-65824: high-severity vulnerability in open-reception appointment-booking-software

OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

Published · Updated

Follow this CVE+ Monitor appointment-booking-software

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 0.3%
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
open-reception · appointment-booking-software
Related CVEs — open-reception appointment-booking-software

In the same product, most dangerous first.

CVE-2026-54460CRITICALOpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeoverEPSS 0.7%CVE-2026-48085CRITICALOpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrapEPSS 0.6%CVE-2026-48087CRITICALOpenReception: WebAuthn passkey injection allows account takeoverEPSS 0.6%CVE-2026-48079HIGHOpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryEPSS 0.5%CVE-2026-48080HIGHOpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deploymentEPSS 0.5%CVE-2026-48086CRITICALOpenReception: Tenant admin self-promotes to GLOBAL_ADMINEPSS 0.4%