Is CVE-2026-65824 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65824 being exploited in the wild.

How severe is CVE-2026-65824?

High severity, with a CVSS score of 7.4, published 23 October 2026.

Which products and versions are affected?

OpenReception Appointment-Booking-Software prior to 2.2.1.

Is there a fix for CVE-2026-65824?

Yes: fixed in 2.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65824 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-65824?

Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65824: OpenReception appointment booking software invite token replay

CVE-2026-65824 · Severity: high · CVSS 7.4 · Published 2026-10-23

OpenReception's appointment booking software allows scheduling and management of appointments with end-to-end encryption. An attacker who intercepts a pending invitation token can replay it to register their own passkey and take control of the invited account, gaining access to tenant or staff contexts and potentially exposing or modifying sensitive appointment data.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-65824 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65824 being exploited in the wild.
How severe is CVE-2026-65824?: High severity, with a CVSS score of 7.4, published 23 October 2026.
Which products and versions are affected?: OpenReception Appointment-Booking-Software prior to 2.2.1.
Is there a fix for CVE-2026-65824?: Yes: fixed in 2.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65824 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-65824?: Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.2.1

Technical details

The vulnerability is a token replay issue in the invite token validation logic. An attacker can capture a pending invite token and replay it multiple times to register a passkey on the target account, bypassing the intended single-use constraint due to a race condition in the confirmation token handling. The fix adds a check to ensure the invite token's "used" flag is false before processing, preventing reuse after the first legitimate registration.

Affected products

OpenReception appointment booking software prior to 2.2.1

Timeline

2026-10-23: disclosed
2026-07-03: patched: Release v2.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.