Open Reception

Vulnérabilités associées 5

• Moyenne 5.3 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The p... CVE-2026-75525 05:42
• Moyenne 5.4 OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointme... CVE-2026-75524 05:29
• Élevée 7.5 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting a... CVE-2026-65825 05:29
• Élevée 7.4 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking... CVE-2026-65824 05:27
• Élevée 8.3 OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pendi... CVE-2026-58202 05:27