Open-reception vulnerabilities
We track 12 vulnerabilities in Open-reception products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest Open-reception vulnerabilities
- 7.5 High severity
appointment-booking-software: Improper Restriction of Excessive Authentication Attempts
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the c
- 7.4 High severity
appointment-booking-software: Authentication Bypass by Capture-replay
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own
- 8.3 High severity
appointment-booking-software: Weak Password Recovery Mechanism for Forgotten Password
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/
- 9.8 Critical severity
appointment-booking-software: Missing Authentication for Critical Functionality
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebA
- 9.4 Critical severity
appointment-booking-software: Missing Authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-KEM-768 public keys ag
- 9.8 Critical severity
appointment-booking-software: Improper Authentication
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at `POST /api/auth/register/{userId}` validates the relationship between the WebAuthn challenge and the
- 9.9 Critical severity
appointment-booking-software: Improper Privilege Management
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts t
- 9.8 Critical severity
appointment-booking-software: Missing Authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates ad
- 7.4 High severity
appointment-booking-software: Improper Restriction of Excessive Authentication Attempts
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known ema
- 8.1 High severity
appointment-booking-software: Improper Neutralization of Input During Web Page Generation
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). Thes
- 8.0 High severity
appointment-booking-software: Exposure of Sensitive Information to an Unauthorized Actor
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint returns the full tenant record to any authenticated `TENANT_ADMIN` of that tenant, includin
- 7.4 High severity
OpenReception's appointment booking software provides an end-to-end encrypted appointment…
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, the page's server-side load handler deletes the `access_token` cookie before callin