CVE-2026-65824 — OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite tok…
Published: 2026-10-23 · CVSS: 7.4 · CVSS 3.1
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
Source: CVE Program · Revision 4a0274f9b163714409d55b9b279b0f8093601287