What’s Vulnerable › Products

open-reception appointment-booking-software vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.

Check whether your open-reception appointment-booking-software version is affected

Latest open-reception appointment-booking-software vulnerabilities

• CVE-2026-75525 — OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant (CVSS 5.3)
• CVE-2026-75524 — OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent (CVSS 5.4)
• CVE-2026-65825 — OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants (CVSS 7.5)
• CVE-2026-65824 — OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie (CVSS 7.4)
• CVE-2026-58202 — OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` (CVSS 8.3)
• CVE-2026-54460 — OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover (CVSS 9.8)
• CVE-2026-48088 — OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory (CVSS 9.4)
• CVE-2026-48087 — OpenReception: WebAuthn passkey injection allows account takeover (CVSS 9.8)
• CVE-2026-48086 — OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN (CVSS 9.9)
• CVE-2026-48085 — OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap (CVSS 9.8)
• CVE-2026-48084 — OpenReception doesn't rate limit passphrase login attempts (CVSS 7.4)
• CVE-2026-48083 — OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits (CVSS 6.5)
• CVE-2026-48082 — OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification (CVSS 3.7)
• CVE-2026-48081 — OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer (CVSS 8.1)
• CVE-2026-48080 — OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment (CVSS 8.0)
• CVE-2026-48079 — OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry (CVSS 7.4)
• CVE-2026-48078 — OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers (CVSS 5.3)
• CVE-2026-48077 — OpenReception: GET appointment by ID returns full appointment record without authorization (CVSS 5.3)
• CVE-2026-48076 — OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels (CVSS 6.5)
• CVE-2026-48075 — OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections (CVSS 6.5)
• CVE-2026-48074 — OpenReception: Staff deletion removes pending invites cross-tenant by email match (CVSS 2.7)
• CVE-2026-48071 — OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout (CVSS 5.8)