OpenReception: Account takeover via spoofed Host header in confirmation emails
Summary
The OpenReception appointment booking software builds account-confirmation links in emails from the Host header of the request, without an allowlist. An unauthenticated attacker can call POST /api/auth/resend-confirmation with a spoofed Host and the email address of a pending invitee. The invitee then receives a confirmation link pointing to the attacker, and if they click it, the attacker can take over the pending account by registering their own passkey. The issue depends on the front proxy: the stock Caddy catch-all forwards spoofed Host headers, while explicit per-tenant proxy blocks are not affected.
Affected
- Versions prior to 2.0.0 (according to the CNA record)
- One third-party source states that all releases through v1.1.0 are affected and that no patch exists. This conflicts with the vendor's 2.0.0 fix and has not been confirmed.
Fixed in
- Version 2.0.0 (according to the CNA record and the vendor release notes)
- Later releases exist. Use the latest release.
Workaround
- Replace the catch-all proxy rule with explicit per-tenant host blocks so that unknown Host values are rejected. This has not been verified against vendor documentation.
Exploitation
- No confirmed exploitation in the wild found.
- CISA SSVC lists exploitation as PoC, not automatable.
- A public PoC is unclear. No CISA KEV listing confirmed.
Our recommendation
- Check the installed version and upgrade to 2.0.0 or, preferably, the latest release.
- If a catch-all proxy rule is used, change it to explicit per-tenant host blocks.
- Review pending invitations and confirmation tokens for unexpected resend requests.
- Verify that all registered passkeys belong to the correct users.
- Check the GitHub advisory and NVD for the final affected version range.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit df54327 github.com
- Release v2.0.0 github.com
- GitHub Security Advisory GHSA-w5g9-g2p4-2g4m github.com
- Strix CVE record CVE-2026-58202 www.strix.ai
- VulDB CVE-2026-58202 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:15.
Original description (NVD)
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker. If the invitee clicks, the one-time confirmation token reaches the attacker, who then confirms the account on the real tenant domain and registers a passkey they control, taking over the account before the legitimate invitee ever uses it. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator who configures explicit per-tenant proxy blocks is not affected (see Details 4). The invite path builds links from the trusted tenant.domain (invite/+server.ts:204-210); the resend-confirmation path builds them from the request Host. This issue has been patched in version 2.0.0.
NVD references (4)
- https://github.com/open-reception/appointment-booking-software/commit/df5432776a1a5b47c3a64d64e9d05dbe2b7a7819
- https://github.com/open-reception/appointment-booking-software/releases/tag/v2.0.0
- https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-w5g9-g2p4-2g4m
- https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-w5g9-g2p4-2g4m
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.