open-reception appointment-booking-software.

OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

• open-reception appointment-booking-software
• Broken access control

OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent

• open-reception appointment-booking-software
• Race condition

OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

• open-reception appointment-booking-software
• Authentication bypass

OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

• open-reception appointment-booking-software
• Authentication bypass

OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

• open-reception appointment-booking-software
• CWE-640

OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

• open-reception appointment-booking-software
• Authentication bypass

OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

• open-reception appointment-booking-software
• Broken access control

OpenReception: WebAuthn passkey injection allows account takeover

• open-reception appointment-booking-software
• Authentication bypass

OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

• open-reception appointment-booking-software
• Privilege escalation

OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

• open-reception appointment-booking-software
• Broken access control

OpenReception doesn't rate limit passphrase login attempts

• open-reception appointment-booking-software
• Authentication bypass

OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits

• open-reception appointment-booking-software
• Other injection

OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

• open-reception appointment-booking-software
• Denial of service

OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer

• open-reception appointment-booking-software
• Cross-site scripting (XSS)

OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

• open-reception appointment-booking-software
• Authentication bypass

OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers

• open-reception appointment-booking-software
• Information disclosure

OpenReception: GET appointment by ID returns full appointment record without authorization

• open-reception appointment-booking-software
• Broken access control

OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

• open-reception appointment-booking-software
• Broken access control

OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

• open-reception appointment-booking-software
• Broken access control

OpenReception: Staff deletion removes pending invites cross-tenant by email match

• open-reception appointment-booking-software
• Broken access control

OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

• open-reception appointment-booking-software
• Authentication bypass

OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

• open-reception appointment-booking-software
• Information disclosure