Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-65824— OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

Quick assessment

Affected
open-reception appointment-booking-software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenReception 的预约预订软件提供了一个端到端加密的预约预订平台。在 2.2.1 版本之前，攻击者若截获了待处理的邀请令牌（invite token），可对其进行重放，从而获取通行密钥（passkey）注册凭证，并在被邀请的账户上注册自己的通行密钥，进而接管该账户。对于员工或租户管理员的邀请，这将导致攻击者获得与该账户关联的租户上下文访问权限。此问题已在 2.2.1 版本中修复。

CVSS 7.4 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-65824

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie
Source: CVE Program / CVE List V5
Vulnerability Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
open-reception appointment-booking-software < 2.2.1 -

II. Public POCs for CVE-2026-65824

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65824

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-65824 (2)

Vendor Advisories for CVE-2026-65824 (1)

Same Patch Batch · open-reception · 2026-10-23 · 5 CVEs total

CVE-2026-58202 8.3 HIGH OpenReception: Confirmation-email links built from the request Host enable pending-account
CVE-2026-65825 7.5 HIGH OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the sam
CVE-2026-75524 5.4 MEDIUM OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping ap
CVE-2026-75525 5.3 MEDIUM OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient direct

IV. Related Vulnerabilities

Same product: appointment-booking-software
Same vendor: open-reception
Same weakness: CWE-294

V. Comments for CVE-2026-65824

No comments yet

Leave a comment