AP
Product
appointment-booking-software
22
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 5High 7Medium 8Low 2
Watch
Add appointment-booking-software to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48086 | 9.9 | Aug 6 | OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN Affected: < 1.0.2 |
| CVE-2026-54460 | 9.8 | Sep 17 | OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover Affected: < 1.1.1 |
| CVE-2026-48087 | 9.8 | Aug 6 | OpenReception: WebAuthn passkey injection allows account takeover Affected: < 1.0.2 |
| CVE-2026-48085 | 9.8 | Aug 6 | OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap Affected: < 1.0.1 |
| CVE-2026-48088 | 9.4 | Aug 6 | OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory Affected: < 1.0.4 |
| CVE-2026-58202 New | 8.3 | Oct 23 | OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` Affected: < 2.0.0 |
| CVE-2026-48081 | 8.1 | Aug 6 | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer Affected: < 1.0.2 |
| CVE-2026-48080 | 8.0 | Aug 6 | OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment Affected: < 1.0.2 |
| CVE-2026-65825 New | 7.5 | Oct 23 | OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants Affected: <= 2.1.0 |
| CVE-2026-65824 New | 7.4 | Oct 23 | OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie Affected: < 2.2.1 |
| CVE-2026-48084 | 7.4 | Aug 6 | OpenReception doesn't rate limit passphrase login attempts Affected: < 1.0.2 |
| CVE-2026-48079 | 7.4 | Aug 6 | OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry Affected: < 1.0.2 |
| CVE-2026-48083 | 6.5 | Aug 6 | OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits Affected: < 1.0.2 |
| CVE-2026-48076 | 6.5 | Aug 6 | OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels Affected: <= 1.0.1 |
| CVE-2026-48075 | 6.5 | Aug 6 | OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections Affected: < 1.0.5 |
| CVE-2026-48071 | 5.8 | Aug 6 | OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout Affected: < 1.0.4 |
| CVE-2026-75524 New | 5.4 | Oct 23 | OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent Affected: < 2.2.2 |
| CVE-2026-75525 New | 5.3 | Oct 23 | OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant Affected: <= 2.1.0 |
| CVE-2026-48078 | 5.3 | Aug 6 | OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers Affected: < 1.0.5 |
| CVE-2026-48077 | 5.3 | Aug 6 | OpenReception: GET appointment by ID returns full appointment record without authorization Affected: < 1.1.0 |
| CVE-2026-48082 | 3.7 | Aug 6 | OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification Affected: < 1.0.6 |
| CVE-2026-48074 | 2.7 | Aug 6 | OpenReception: Staff deletion removes pending invites cross-tenant by email match Affected: < 1.0.6 |
Showing 22