Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-58202— OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

Quick assessment

Affected
open-reception appointment-booking-software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenReception 的预约预订软件提供了一个端到端加密的预约预订平台。在 2.0.0 版本之前，邮件中的账户确认链接是根据请求的 Host 头动态生成的，且未实施任何白名单限制。未经验证的 接口会轮换待确认受邀者的确认令牌，并发送一封包含链接的邮件，该链接中的主机名直接取自请求的 Host 头。攻击者只需向该接口发送一条 的 请求，并指定某位待确认受邀者的邮箱地址，即可导致该受邀者收到一封确认邮件，其中唯一的链接指向攻击者控制的域名。一旦受邀者点击该链接，一次性确认令牌便会泄露给攻击者；攻击者随后可在真实的

CVSS 8.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-58202

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`
Source: CVE Program / CVE List V5
Vulnerability Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
open-reception appointment-booking-software < 2.0.0 -

II. Public POCs for CVE-2026-58202

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-58202

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-58202 (1)

Vendor Advisories for CVE-2026-58202 (1)

Same Patch Batch · open-reception · 2026-10-23 · 5 CVEs total

CVE-2026-65825 7.5 HIGH OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the sam
CVE-2026-65824 7.4 HIGH OpenReception: invite confirmation token is replayable within its validity window and re-i
CVE-2026-75524 5.4 MEDIUM OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping ap
CVE-2026-75525 5.3 MEDIUM OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient direct

IV. Related Vulnerabilities

Same product: appointment-booking-software
Same vendor: open-reception
Same weakness: CWE-640

V. Comments for CVE-2026-58202

No comments yet

Leave a comment