CVE-2026-65824highCWE-294

CVE-2026-65824: fallo de gravedad alta en open-reception appointment-booking-software

OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear appointment-booking-software

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.3%
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
open-reception · appointment-booking-software
CVEs relacionadas — open-reception appointment-booking-software

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54460CRITICALOpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeoverEPSS 0.7%CVE-2026-48085CRITICALOpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrapEPSS 0.6%CVE-2026-48087CRITICALOpenReception: WebAuthn passkey injection allows account takeoverEPSS 0.6%CVE-2026-48079HIGHOpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryEPSS 0.5%CVE-2026-48080HIGHOpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deploymentEPSS 0.5%CVE-2026-48086CRITICALOpenReception: Tenant admin self-promotes to GLOBAL_ADMINEPSS 0.4%