# CVE-2026-65824: OpenReception appointment booking software invite token replay

Source: https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-65824 · Severity: high · CVSS 7.4 · Published 2026-10-23

OpenReception's appointment booking software allows scheduling and management of appointments with end-to-end encryption. An attacker who intercepts a pending invitation token can replay it to register their own passkey and take control of the invited account, gaining access to tenant or staff contexts and potentially exposing or modifying sensitive appointment data.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-65824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65824 being exploited in the wild.

**How severe is CVE-2026-65824?** High severity, with a CVSS score of 7.4, published 23 October 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software prior to 2.2.1.

**Is there a fix for CVE-2026-65824?** Yes: fixed in 2.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65824 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-65824?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.2.1

## Technical details

The vulnerability is a token replay issue in the invite token validation logic. An attacker can capture a pending invite token and replay it multiple times to register a passkey on the target account, bypassing the intended single-use constraint due to a race condition in the confirmation token handling. The fix adds a check to ensure the invite token's "used" flag is false before processing, preventing reuse after the first legitimate registration.

## Affected products

- OpenReception appointment booking software prior to 2.2.1

## Timeline

- 2026-10-23: disclosed
- 2026-07-03: patched: Release v2.2.1

## References

- [https://github.com/open-reception/appointment-booking-software/commit/da921eb9d36953276577c0a6deb9267bfec03622](https://github.com/open-reception/appointment-booking-software/commit/da921eb9d36953276577c0a6deb9267bfec03622)
- [https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.1](https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.1)

## Related threats

- [OpenReception Appointment Booking unauthenticated ML-KEM key injection](https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software authentication bypass in PIN throttle](https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception Appointment Booking Software authentication bypass in passkey enrollment](https://junglewise.ai/threats/cve-2026-54460-openreception-appointment-booking-software-authentication-bypass)