Vulnerability Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/open-reception/appointment-booking-software/commit/da921eb9d3
- https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2
- https://github.com/open-reception/appointment-booking-software/security/advisori
FAQ
What is CVE-2026-65824?
CVE-2026-65824 is a vulnerability with a CVSS score of 7.4 (HIGH). OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obt...
How severe is CVE-2026-65824?
CVE-2026-65824 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65824?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.