OpenReception
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 15 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from August 6, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover
OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory
OpenReception: WebAuthn passkey injection allows account takeover
OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits
OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification
OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer
OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
Monitor OpenReception in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.