{"id":"CVE-2026-58202","aliases":[],"cve":{"records":[{"id":"CVE-2026-58202","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-29T17:09:25.872Z","published":"2026-10-23T20:27:36.090Z","modified":"2026-10-29T18:16:47.209Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T20:27:36.090Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T18:16:47.209Z"}],"references":[{"url":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-w5g9-g2p4-2g4m","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/open-reception/appointment-booking-software/commit/df5432776a1a5b47c3a64d64e9d05dbe2b7a7819","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/open-reception/appointment-booking-software/releases/tag/v2.0.0","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-w5g9-g2p4-2g4m","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-640","description":"CWE-640: Weak Password Recovery Mechanism for Forgotten Password","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T18:16:21.166284Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.","score":8.3,"severity":"high","published":"2026-10-23T20:27:36.090Z","modified":"2026-10-29T18:16:47.209Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"open-reception","name":"appointment-booking-software","platforms":[],"versions":[{"version":"< 2.0.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-58202"}],"remediation":[],"references":["https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-w5g9-g2p4-2g4m","https://github.com/open-reception/appointment-booking-software/commit/df5432776a1a5b47c3a64d64e9d05dbe2b7a7819","https://github.com/open-reception/appointment-booking-software/releases/tag/v2.0.0"],"sources":[{"name":"CVE","id":"CVE-2026-58202","modified":"2026-10-29T18:16:47.209Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-58202"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","score":8.3}],"sourceAffected":[],"observedAt":"2026-10-29T18:50:07.861Z","kev":{"status":"not-listed","checkedAt":"2026-11-05T11:05:32.134Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T08:05:39.013Z","attemptedAt":"2026-10-30T08:05:39.013Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T08:05:39.212Z","attemptedAt":"2026-10-30T08:05:39.212Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T08:05:38.390Z","attemptedAt":"2026-10-30T08:05:38.390Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T08:05:38.103Z","attemptedAt":"2026-10-30T08:05:38.103Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-58202","url":"https://www.first.org/epss/","probability":0.00236,"percentile":0.14675,"date":"2026-10-29","checkedAt":"2026-10-30T08:05:38.103Z"},{"source":"ENISA EUVD","id":"EUVD-2026-109154","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109154","modified":"Oct 29, 2026, 6:16:47 PM","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","checkedAt":"2026-10-30T08:05:38.390Z"},{"source":"NVD","id":"CVE-2026-58202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58202","modified":"2026-10-29T19:17:23.980","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","checkedAt":"2026-10-30T08:05:39.013Z"}],"aiSummary":{"text":"OpenReception's appointment booking software, versions prior to 2.0.0, has a weakness where an unauthenticated attacker can send a POST request to /api/auth/resend-confirmation with a spoofed Host header, potentially taking over a pending account. The attacker must have access to the invitee's email. The impact is account takeover.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T12:51:36.626Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-58202"}]}}