CVE-2026-65824: OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenReceptionto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must capture a pending invite confirmation token while it remains valid. They can then replay the token to obtain a passkey-registration credential and register their own passkey for the invited account.
Which accounts create the greatest exposure?
Any invited account can be taken over if its pending invite token is captured and replayed. Staff and tenant-admin invitations have greater impact because compromise gives the attacker access to the tenant context associated with that account.
Are deployments running the fixed release affected?
No. The issue is patched in OpenReception version 2.2.1; versions prior to 2.2.1 are affected.