Remote Code Execution in OpenReception's Appointment Booking Software

CVE-2026-54460

What is CVE-2026-54460?

OpenReception's appointment booking software enables users to schedule appointments securely. However, prior to version 1.1.1, an authentication flaw exists that allows an unauthenticated attacker to exploit userId values and compromise user sessions. By leveraging a combination of the public tenant ID and a known target staff email, attackers can manipulate the system to inject credentials, leading to unauthorized access. This exploitation can result in the hijacking of STAF sessions, potentially exposing sensitive tenant information and enabling subsequent administrative takeover. The issue has been resolved in version 1.1.1.

References