{"id":"CVE-2026-58202","kind":"vulnerability","aliases":["CVE-2026-58202"],"related":[],"title":"OpenReception: Host header poisoning lets attackers take over invited accounts","description":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.","summary":"OpenReception builds account-confirmation links in emails from the request Host header, and an unauthenticated resend-confirmation request can make a pending invitee receive a link pointing to an attacker's host. If the invitee clicks, the attacker captures the one-time token, confirms the account and registers their own passkey.","severity":"high","cvss":8.3,"epss":0.00429,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appointment-booking","caddy","openreception","package","self-hosted"],"not_affected_if":["explicit-per-tenant-proxy-blocks","version-2.0.0-or-later"],"how_to_check":"- Check the OpenReception version: releases through `v1.1.0` are affected.\n- Check the front proxy config: the stock Caddy catch-all forwards arbitrary Host headers, while explicit per-tenant proxy blocks are not affected.","fix":"- Upgrade OpenReception to `2.0.0`, which contains the fix.\n- Until upgraded, configure explicit per-tenant proxy blocks in Caddy so arbitrary Host headers are not forwarded (unknown whether this fully mitigates beyond the sources' description).","status":"open","published_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:02:01+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:02:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenReception to `2.0.0`, which contains the fix.\n- Until upgraded, configure explicit per-tenant proxy blocks in Caddy so arbitrary Host headers are not forwarded (unknown whether this fully mitigates beyond the sources' description).","reach":"internet","title":"OpenReception: Host header poisoning lets attackers take over invited accounts","impact":"high","summary":"OpenReception builds account-confirmation links in emails from the request Host header, and an unauthenticated resend-confirmation request can make a pending invitee receive a link pointing to an attacker's host. If the invitee clicks, the attacker captures the one-time token, confirms the account and registers their own passkey.","category":"package","nicknames":[],"who_cares":["self-hosted","openreception","caddy","appointment-booking"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over pending invitee accounts and registers their own passkey.","analyst_note":"","how_to_check":"- Check the OpenReception version: releases through `v1.1.0` are affected.\n- Check the front proxy config: the stock Caddy catch-all forwards arbitrary Host headers, while explicit per-tenant proxy blocks are not affected.","needs_analyst":false,"not_affected_if":["version-2.0.0-or-later","explicit-per-tenant-proxy-blocks"],"who_is_affected":"Operators running OpenReception releases through v1.1.0 behind the stock Caddy catch-all proxy, which forwards spoofed Host headers to the app. Operators using explicit per-tenant proxy blocks are not affected according to the sources. Teams that have already upgraded to 2.0.0 can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":3624,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-210':269C '-58202':13A,16A '/api/auth/resend-confirmation':119C '2.0.0':98C,288C '4':257C 'account':10A,29B,74B,101C,186C,201C 'account-confirm':28B,100C 'affect':215C,254C 'allowlist':115C 'app':223C 'appoint':18B,82C,92C 'appointment-book':17B 'attack':6A,57B,65B,138C,168C,181C 'attacker.example':147C 'block':251C 'book':19B,83C,93C 'build':27B,261C,275C 'built':107C 'caddi':20B,235C 'captur':66B 'catch':237C 'catch-al':236C 'caus':154C 'click':63B,172C 'come':133C 'configur':245C 'confirm':30B,44B,72B,102C,125C,144C,160C,177C,184C,273C 'control':197C 'cve':11A,14A 'depend':228C 'detail':256C 'domain':191C 'email':33B,105C,128C,153C,161C 'encrypt':91C 'end':88C,90C 'end-to-end':87C 'ever':206C 'exist':219C 'explicit':246C 'forward':239C 'front':231C 'header':3A,38B,112C 'host':2A,25B,37B,59B,111C,132C,146C,227C,280C 'invit':9A,259C,267C 'invite':50B,62B,123C,151C,156C,171C,205C 'issu':282C 'legitim':204C 'let':5A 'link':31B,53B,103C,130C,164C,262C 'make':47B 'one':69B,141C,175C 'one-tim':68B,174C 'openrecept':1A,21B,26B,80C 'oper':243C 'packag':22B 'passkey':79B,195C 'patch':217C,285C 'path':260C,274C 'pend':49B,122C,150C 'per':248C 'per-ten':247C 'platform':94C 'point':54B,165C 'poison':4A 'post':118C 'prior':95C 'provid':85C 'proxi':232C,250C 'reach':179C,221C 'real':189C 'receiv':51B,158C 'regist':76B,193C 'releas':210C 'request':36B,45B,110C,136C,279C 'resend':43B,143C,272C 'resend-confirm':42B,142C,271C 'rotat':120C 'see':255C 'self':24B 'self-host':23B 'send':140C 'server.ts:204':268C 'softwar':84C 'spoof':226C 'stock':234C 'take':7A,198C 'tenant':190C,249C 'tenant.domain':266C 'time':70B,176C 'token':71B,126C,178C 'trust':265C 'unauthent':41B,117C 'use':207C 'v1.1.0':213C 'version':97C,211C,218C,287C 'whose':131C,162C 'yet':220C","nicknames":[],"mitigations":[],"who_affected":"Operators running OpenReception releases through v1.1.0 behind the stock Caddy catch-all proxy, which forwards spoofed Host headers to the app. Operators using explicit per-tenant proxy blocks are not affected according to the sources. Teams that have already upgraded to 2.0.0 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T21:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58202","severity":null,"published_at":"2026-10-23T21:17:24+00:00","modified_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-58202","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-58202","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}