OpenReception Appointment Booking Software Vulnerability Exposes User Accounts

CVE-2026-58202

What is CVE-2026-58202?

The appointment booking software from OpenReception prior to version 2.0.0 contains a vulnerability that allows attackers to exploit the account-confirmation process. Specifically, the software generates the link for account confirmation emails from the Host header of the request without any validation or allowlisting. An attacker can trigger this by sending a specially crafted request, causing a pending invitee to receive a malicious confirmation email. When the invitee clicks the link, the attacker gains access to a one-time confirmation token, allowing them to take over the account. This vulnerability affects all releases up to v1.1.0, and no fix is available until version 2.0.0 is implemented.

References