{"id":"CVE-2026-65824","kind":"vulnerability","aliases":["CVE-2026-65824"],"related":[],"title":"OpenReception: replayed invite token lets attacker register passkey on invited account","description":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.","summary":"OpenReception's appointment booking software before 2.2.1 lets an attacker who captures a pending invite token replay it to obtain a passkey-registration credential. The attacker can then register their own passkey on the invited account and take it over, including the tenant context for staff or tenant-admin invites.","severity":"high","cvss":7.4,"epss":0.00419,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appointment-booking","openreception","package","self-hosted"],"not_affected_if":["version-2.2.1-or-later"],"how_to_check":"- Check the installed OpenReception version; unknown whether the sources give a specific command or file.\n- Look for pending invites that were sent before the upgrade, since they may still hold replayable tokens: unknown whether the sources name a location.","fix":"- Upgrade OpenReception to `2.2.1` or later.\n- After upgrading, re-issue any pending invites and treat tokens sent before the upgrade as possibly captured: unknown whether the sources give further steps.","status":"open","published_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:25:27+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:25:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenReception to `2.2.1` or later.\n- After upgrading, re-issue any pending invites and treat tokens sent before the upgrade as possibly captured: unknown whether the sources give further steps.","reach":"unknown","title":"OpenReception: replayed invite token lets attacker register passkey on invited account","impact":"high","summary":"OpenReception's appointment booking software before 2.2.1 lets an attacker who captures a pending invite token replay it to obtain a passkey-registration credential. The attacker can then register their own passkey on the invited account and take it over, including the tenant context for staff or tenant-admin invites.","category":"package","nicknames":[],"who_cares":["openreception","self-hosted","appointment-booking"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over invited account and gains tenant admin access","analyst_note":"Sources give no product-specific check or invite-token exposure details; confirm how invite tokens travel and whether pre-upgrade invites need revoking, via the NVD entry and the OpenReception release notes.","how_to_check":"- Check the installed OpenReception version; unknown whether the sources give a specific command or file.\n- Look for pending invites that were sent before the upgrade, since they may still hold replayable tokens: unknown whether the sources name a location.","needs_analyst":true,"not_affected_if":["version-2.2.1-or-later"],"who_is_affected":"Teams running OpenReception before 2.2.1 that send invites to staff or tenant-admin accounts are exposed, because an invite token captured in transit or from mail can be used to take over the invited account. Installations already on 2.2.1 or later are not affected by this issue.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3349,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65824':14A,17A '2.2.1':32B,96C,155C 'access':139C 'account':11A,62B,123C,128C,147C 'admin':76B,135C 'appoint':19B,28B,80C,90C 'appointment-book':18B 'attack':6A,35B,52B,98C 'book':20B,29B,81C,91C 'captur':37B,100C 'context':70B,143C 'control':125C 'credenti':50B,114C 'cve':12A,15A 'encrypt':89C 'end':86C,88C 'end-to-end':85C 'host':25B 'includ':67B 'invit':3A,10A,40B,61B,77B,103C,122C,136C 'issu':149C 'let':5A,33B 'obtain':45B,109C 'openrecept':1A,21B,26B,78C 'packag':22B 'passkey':8A,48B,58B,112C,119C 'passkey-registr':47B,111C 'patch':152C 'pend':39B,102C 'platform':92C 'prior':93C 'provid':83C 'regist':7A,55B,116C 'registr':49B,113C 'replay':2A,42B,106C 'self':24B 'self-host':23B 'softwar':30B,82C 'staff':72B,131C 'take':64B,124C 'tenant':69B,75B,134C,142C 'tenant-admin':74B,133C 'tie':144C 'token':4A,41B,104C 'version':95C,154C 'yield':138C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenReception before 2.2.1 that send invites to staff or tenant-admin accounts are exposed, because an invite token captured in transit or from mail can be used to take over the invited account. Installations already on 2.2.1 or later are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T21:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65824","severity":null,"published_at":"2026-10-23T21:17:24+00:00","modified_at":"2026-10-23T21:17:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-65824","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-65824","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}