I audited #OpenReception, a recently released open-source appointment booking platform. Found and reported 16 vulnerabilities, now 16 CVEs assigned.

4 critical:

  • WebAuthn passkey injection → account takeover
  • tenant admin self-promotes to GLOBAL_ADMIN
  • unauth GLOBAL_ADMIN account creation
  • staff crypto poisoning breaks the E2E recipient directory

rest: info disclosure, stored XSS, auth and IDOR bugs, all patched before public disclosure.

https://moltenbit.net/disclosures/

#infosec #security #CVE