open-reception vulnerabilities

Newest CVEs

• CVE-2026-75525

  OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

  open-reception · appointment-booking-software

  Medium5.3
• CVE-2026-75524

  OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent

  open-reception · appointment-booking-software

  Medium5.4
• CVE-2026-65825

  OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

  open-reception · appointment-booking-software

  High7.5
• CVE-2026-65824

  OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

  open-reception · appointment-booking-software

  High7.4
• CVE-2026-58202

  OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

  open-reception · appointment-booking-software

  High8.3
• CVE-2026-54460

  OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

  open-reception · appointment-booking-software

  Critical9.8
• CVE-2026-48088

  OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

  open-reception · appointment-booking-software

  Critical9.4
• CVE-2026-48087

  OpenReception: WebAuthn passkey injection allows account takeover

  open-reception · appointment-booking-software

  Critical9.8
• CVE-2026-48086

  OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

  open-reception · appointment-booking-software

  Critical9.9
• CVE-2026-48085

  OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

  open-reception · appointment-booking-software

  Critical9.8