Replay Vulnerability in OpenReception Appointment Booking Software

CVE-2026-65824

What is CVE-2026-65824?

The OpenReception appointment booking software is vulnerable to a replay attack where an attacker can intercept a pending invite token. If successfully captured, this token can be leveraged to acquire a passkey-registration credential, allowing the attacker to register a control passkey on the compromised account. This presents a serious risk, particularly for staff or tenant-admin invites, where it grants unauthorized access to sensitive tenant contexts. Users are advised to upgrade to version 2.2.1 or later to mitigate this risk.

References