{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopenreceptionappointment_booking_software/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openreception:appointment_booking_software:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-58202"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["appointment booking software (\u003c 2.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenReception"],"content_html":"\u003cp\u003eOpenReception versions prior to 2.0.0 contain a vulnerability in the '/api/auth/resend-confirmation' endpoint where the Host header is used to construct account confirmation links without validation or allowlisting. An unauthenticated attacker can force the system to send an email to a victim containing a link directed to an attacker-controlled domain. When the victim clicks the link, the one-time confirmation token is exposed, enabling the attacker to finalize the account registration and attach an attacker-controlled passkey.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target user's email address associated with a pending invite.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to '/api/auth/resend-confirmation'.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious hostname into the 'Host' header of the request.\u003c/li\u003e\n\u003cli\u003eApplication generates a confirmation email containing a link using the malicious host.\u003c/li\u003e\n\u003cli\u003eVictim receives the confirmation email and clicks the malicious link.\u003c/li\u003e\n\u003cli\u003eAttacker captures the one-time confirmation token from the request logs at their server.\u003c/li\u003e\n\u003cli\u003eAttacker uses the token to confirm the account on the legitimate tenant domain.\u003c/li\u003e\n\u003cli\u003eAttacker registers a passkey and completes the account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover, allowing attackers to access private booking data and assume the identity of the victim user within the platform.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenReception to version 2.0.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict Host header validation or explicit per-tenant proxy configurations in front-end proxies (e.g., Caddy, Nginx) to ensure requests only match authorized tenant domains.\u003c/li\u003e\n\u003cli\u003eAudit logs for the '/api/auth/resend-confirmation' endpoint to identify requests containing unrecognized or anomalous 'Host' headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T22:05:14Z","date_published":"2026-10-23T22:05:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openreception-host-injection/","summary":"OpenReception appointment booking software prior to version 2.0.0 is vulnerable to host header injection in the confirmation email generation process, allowing unauthenticated attackers to hijack user accounts.","title":"OpenReception: Host header injection account takeover (CVE-2026-58202)","url":"https://feed.craftedsignal.io/briefs/2026-10-openreception-host-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:openreception:appointment_booking_software:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}