CVE-2026-65824highCWE-294

CVE-2026-65824: falha de alta gravidade em open-reception appointment-booking-software

OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar appointment-booking-software

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.3%
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
open-reception · appointment-booking-software
CVEs relacionadas — open-reception appointment-booking-software

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54460CRITICALOpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeoverEPSS 0.7%CVE-2026-48085CRITICALOpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrapEPSS 0.6%CVE-2026-48087CRITICALOpenReception: WebAuthn passkey injection allows account takeoverEPSS 0.6%CVE-2026-48079HIGHOpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryEPSS 0.5%CVE-2026-48080HIGHOpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deploymentEPSS 0.5%CVE-2026-48086CRITICALOpenReception: Tenant admin self-promotes to GLOBAL_ADMINEPSS 0.4%