Is CVE-2026-58202 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58202 being exploited in the wild.

How severe is CVE-2026-58202?

High severity, with a CVSS score of 8.3, published 23 October 2026.

Which products and versions are affected?

OpenReception Appointment-Booking-Software prior to 2.0.0, including all versions through 1.1.1.

How is CVE-2026-58202 attacked?

It is attacked over the network.

Am I affected by CVE-2026-58202?

Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58202: OpenReception appointment booking account takeover via Host header spoofing

CVE-2026-58202 · Severity: high · CVSS 8.3 · Published 2026-10-23

OpenReception is an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, an attacker can intercept account confirmation emails by manipulating the Host header, causing pending invitees to receive confirmation links pointing to the attacker's domain. When the invitee clicks the link, their one-time token is leaked to the attacker, who then completes account registration and sets up their own authentication, locking out the legitimate user.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-58202 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58202 being exploited in the wild.
How severe is CVE-2026-58202?: High severity, with a CVSS score of 8.3, published 23 October 2026.
Which products and versions are affected?: OpenReception Appointment-Booking-Software prior to 2.0.0, including all versions through 1.1.1.
Is there a fix for CVE-2026-58202?: Yes: fixed in 2.0.0. Until then: Configure the front-end proxy with explicit per-tenant allowlists rather than catch-all forwarding to block spoofed Host headers from reaching the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58202 attacked?: It is attacked over the network.
Am I affected by CVE-2026-58202?: Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.0

Configure the front-end proxy with explicit per-tenant allowlists rather than catch-all forwarding to block spoofed Host headers from reaching the application.

Technical details

The unauthenticated POST /api/auth/resend-confirmation endpoint builds confirmation links from the request Host header without validation or allowlist, differing from the invite path which uses the trusted tenant domain. An attacker sends a resend-confirmation request with a spoofed Host header and a pending invitee's email address; the invitee receives an email with a link to the attacker's domain. When clicked, the one-time confirmation token is exposed to the attacker, who can then confirm the account on the legitimate domain and register a passkey before the invitee. Exploitation requires the front-end proxy to forward the spoofed Host (e.g., stock Caddy configuration); per-tenant proxy allowlists would block this attack.

Affected products

OpenReception appointment booking software prior to 2.0.0, including all versions through 1.1.1

Timeline

2026-10-23: disclosed
2026-06-19: patched: version 2.0.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.