Product by Open-reception

    Appointment-booking-software

    22 known vulnerabilities in Appointment-booking-software (Open-reception), 0 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Appointment-booking-software (Open-reception)
    CriticalCVE-2026-54460

    Open-reception Appointment-booking-software: Missing Authentication for Critical Function

    		9.8
    CriticalCVE-2026-48085

    OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

    		9.8
    CriticalCVE-2026-48087

    OpenReception: WebAuthn passkey injection allows account takeover

    		9.8
    CriticalCVE-2026-48086

    OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

    		9.9
    CriticalCVE-2026-48088

    Open-reception Appointment-booking-software: Missing Authorization

    		9.4
    HighCVE-2026-48080

    Open-reception Appointment-booking-software: Exposure of Sensitive Information to an Unauthorized Actor

    		8.0
    HighCVE-2026-48079

    Open-reception Appointment-booking-software: Insufficient Session Expiration

    		7.4
    HighCVE-2026-58202

    Open-reception Appointment-booking-software: Weak Password Recovery Mechanism for Forgotten Password

    		8.3
    HighCVE-2026-65824

    Open-reception Appointment-booking-software: Authentication Bypass by Capture-replay

    		7.4
    HighCVE-2026-65825

    Open-reception Appointment-booking-software: Improper Restriction of Excessive Authentication Attempts

    		7.5
    HighCVE-2026-48084

    OpenReception doesn't rate limit passphrase login attempts

    		7.4
    MediumCVE-2026-48075

    OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

    		6.5
    HighCVE-2026-48081

    Open-reception Appointment-booking-software: Cross-site Scripting

    		8.1
    MediumCVE-2026-48083

    Open-reception Appointment-booking-software: Improper Output Neutralization for Logs

    		6.5
    MediumCVE-2026-48071

    Open-reception Appointment-booking-software: Improper Restriction of Excessive Authentication Attempts

    		5.8
    MediumCVE-2026-48076

    OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

    		6.5
    MediumCVE-2026-48077

    OpenReception: GET appointment by ID returns full appointment record without authorization

    		5.3
    MediumCVE-2026-75524

    Open-reception Appointment-booking-software: Time-of-check Time-of-use (TOCTOU) Race Condition

    		5.4
    MediumCVE-2026-75525

    Open-reception Appointment-booking-software: Incorrect Authorization

    		5.3
    MediumCVE-2026-48078

    Open-reception Appointment-booking-software: Exposure of Sensitive Information to an Unauthorized Actor

    		5.3
    LowCVE-2026-48082

    Open-reception Appointment-booking-software: Allocation of Resources Without Limits or Throttling

    		3.7
    LowCVE-2026-48074

    OpenReception: Staff deletion removes pending invites cross-tenant by email match

    		2.7

    All products by Open-reception