Vulnerabilities

TI-2026-79994 CVE-2026-75525

Incorrect authorization in OpenReception lets attackers add staff keys

MEDIUM 63

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00173 Published 2026-10-23 No fix listed CWE-863

TI-2026-79993 CVE-2026-75524

Race condition in OpenReception allows overlapping agent appointments

MEDIUM 58

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00266 Published 2026-10-23 Fixed in 2.2.2 CWE-367

TI-2026-79992 CVE-2026-65825

Cross-tenant bypass of PIN brute-force throttle in OpenReception

LOW 32

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00216 Published 2026-10-23 No fix listed CWE-307

TI-2026-79991 CVE-2026-65824

Replayable invite token in OpenReception enables account takeover

LOW 34

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00252 Published 2026-10-23 Fixed in 2.2.1 CWE-294

TI-2026-79990 CVE-2026-58202

Host header poisoning in OpenReception enables account takeover

HIGH 71

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00236 Published 2026-10-23 Fixed in 2.0.0 CWE-640

TI-2026-39318 CVE-2026-54460

OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

MEDIUM 50

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00697 Published 2026-09-17 Fixed in 1.1.1 CWE-306

TI-2026-35529 CVE-2026-48088

OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

HIGH 82

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00377 Published 2026-08-06 Fixed in 1.0.4 CWE-862

TI-2026-35528 CVE-2026-48087

OpenReception: WebAuthn passkey injection allows account takeover

HIGH 82

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00574 Published 2026-08-06 Fixed in 1.0.2 CWE-287

TI-2026-35527 CVE-2026-48086

OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

HIGH 76

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00442 Published 2026-08-06 Fixed in 1.0.2 CWE-269

TI-2026-35526 CVE-2026-48085

OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

HIGH 82

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00591 Published 2026-08-06 Fixed in 1.0.1 CWE-862

TI-2026-35525 CVE-2026-48084

OpenReception doesn't rate limit passphrase login attempts

HIGH 68

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00388 Published 2026-08-06 Fixed in 1.0.2 CWE-307

TI-2026-35524 CVE-2026-48083

OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits

HIGH 68

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00364 Published 2026-08-06 Fixed in 1.0.2 CWE-117

TI-2026-35523 CVE-2026-48082

Resource allocation without limits in open-reception appointment-booking-software

MEDIUM 51

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00386 Published 2026-08-06 Fixed in 1.0.6 CWE-770

TI-2026-35522 CVE-2026-48081

OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer

HIGH 70

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00244 Published 2026-08-06 Fixed in 1.0.2 CWE-79

TI-2026-35520 CVE-2026-48079

Insufficient session expiration in open-reception appointment-booking-software

LOW 35

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00501 Published 2026-08-06 Fixed in 1.0.2 CWE-613

TI-2026-35519 CVE-2026-48078

OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers

MEDIUM 63

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00343 Published 2026-08-06 Fixed in 1.0.5 CWE-200

TI-2026-35518 CVE-2026-48077

OpenReception: GET appointment by ID returns full appointment record without authorization

MEDIUM 63

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00434 Published 2026-08-06 Fixed in 1.1.0 CWE-862

TI-2026-35517 CVE-2026-48076

OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

HIGH 68

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-08-06 No fix listed CWE-863

TI-2026-35516 CVE-2026-48075

OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

MEDIUM 62

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0042 Published 2026-08-06 Fixed in 1.0.5 CWE-862

TI-2026-35515 CVE-2026-48074

OpenReception: Staff deletion removes pending invites cross-tenant by email match

MEDIUM 47

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00292 Published 2026-08-06 Fixed in 1.0.6 CWE-863

TI-2026-35512 CVE-2026-48071

OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

HIGH 65

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00396 Published 2026-08-06 Fixed in 1.0.4 CWE-307

TI-2026-35521 CVE-2026-48080

Information disclosure in open-reception appointment-booking-software

HIGH 70

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00469 Published 2026-08-06 Fixed in 1.0.2 CWE-200

Vulnerabilities

Filters