OpenReception: Host header injection account takeover (CVE-2026-58202)

OpenReception versions prior to 2.0.0 contain a vulnerability in the '/api/auth/resend-confirmation' endpoint where the Host header is used to construct account confirmation links without validation or allowlisting. An unauthenticated attacker can force the system to send an email to a victim containing a link directed to an attacker-controlled domain. When the victim clicks the link, the one-time confirmation token is exposed, enabling the attacker to finalize the account registration and attach an attacker-controlled passkey.

Attack Chain

1. Attacker identifies a target user's email address associated with a pending invite.
2. Attacker sends a POST request to '/api/auth/resend-confirmation'.
3. Attacker injects a malicious hostname into the 'Host' header of the request.
4. Application generates a confirmation email containing a link using the malicious host.
5. Victim receives the confirmation email and clicks the malicious link.
6. Attacker captures the one-time confirmation token from the request logs at their server.
7. Attacker uses the token to confirm the account on the legitimate tenant domain.
8. Attacker registers a passkey and completes the account takeover.

Impact

Successful exploitation results in full account takeover, allowing attackers to access private booking data and assume the identity of the victim user within the platform.

Recommendation

• Upgrade OpenReception to version 2.0.0 or later immediately.
• Implement strict Host header validation or explicit per-tenant proxy configurations in front-end proxies (e.g., Caddy, Nginx) to ensure requests only match authorized tenant domains.
• Audit logs for the '/api/auth/resend-confirmation' endpoint to identify requests containing unrecognized or anomalous 'Host' headers.