appointment-booking-software vulnerabilities
CVEs whose affected-version data names the appointment-booking-software package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-65824High· 7.4OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential…
CVE-2026-58202High· 8.3OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The una…
CVE-2026-75524Medium· 5.4OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is …
CVE-2026-65825High· 7.5OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A succes…
CVE-2026-75525Medium· 5.3OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's i…
CVE-2026-54460Critical· 9.8OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated sess…