Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

open-reception — Vulnerabilities & Security Advisories 22

Browse all 22 CVE security advisories affecting open-reception. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page documents known cybersecurity vulnerabilities for the open-reception vendor and its associated products, categorized by general weakness types and associated security tags. It aggregates a comprehensive collection of security flaws, ranging from critical remote code execution risks to lower-severity configuration errors and information disclosure issues. The dataset covers historical records and recent updates, providing a continuous timeline of security events affecting this vendor’s software ecosystem without restricting the scope to a specific single year. Here, users can systematically track a vendor's official advisories to stay informed about ongoing risk mitigation efforts and patch availability. Visitors may also use the data to deeply understand a specific weakness class within the context of this particular vendor’s implementation, observing how common flaws manifest in their unique architecture. Additionally, individuals can look up a product's vulnerability history to assess past exposure, analyze trends in issue resolution, and make informed decisions regarding procurement or maintenance cycles. This resource serves as a centralized reference point for security analysts, developers, and procurement teams who require accurate, consolidated intelligence on the security posture of open-reception solutions. By consolidating diverse reports into a single view, the page facilitates efficient research and reduces the time required to assess the overall risk profile of these systems.

Top products by open-reception: appointment-booking-software
CVE ID Title CVSS Severity Published
CVE-2026-75525 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant — appointment-booking-software CWE-863 5.3 Medium 2026-10-23
CVE-2026-75524 OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent — appointment-booking-software CWE-367 5.4 Medium 2026-10-23
CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants — appointment-booking-software CWE-307 7.5 High 2026-10-23
CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie — appointment-booking-software CWE-294 7.4 High 2026-10-23
CVE-2026-58202 OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` — appointment-booking-software CWE-640 8.3 High 2026-10-23
CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover — appointment-booking-software CWE-306 9.8 Critical 2026-09-17
CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory — appointment-booking-software CWE-862 9.4 Critical 2026-08-06
CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover — appointment-booking-software CWE-287 9.8 Critical 2026-08-06
CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN — appointment-booking-software CWE-269 9.9 Critical 2026-08-06
CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap — appointment-booking-software CWE-862 9.8 Critical 2026-08-06
CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts — appointment-booking-software CWE-307 7.4 High 2026-08-06
CVE-2026-48083 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits — appointment-booking-software CWE-117 6.5 Medium 2026-08-06
CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification — appointment-booking-software CWE-770 3.7 Low 2026-08-06
CVE-2026-48081 OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer — appointment-booking-software CWE-79 8.1 High 2026-08-06
CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry — appointment-booking-software CWE-613 7.4 High 2026-08-06
CVE-2026-48078 OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers — appointment-booking-software CWE-200 5.3 Medium 2026-08-06
CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization — appointment-booking-software CWE-862 5.3 Medium 2026-08-06
CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels — appointment-booking-software CWE-863 6.5 Medium 2026-08-06
CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections — appointment-booking-software CWE-862 6.5 Medium 2026-08-06
CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match — appointment-booking-software CWE-863 2.7 Low 2026-08-06
CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout — appointment-booking-software CWE-307 5.8 Medium 2026-08-06
CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment — appointment-booking-software CWE-200 8.0 High 2026-08-06

This page lists every published CVE security advisory associated with open-reception. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.