I audited #OpenReception, a recently released open-source appointment booking platform. Found and reported 16 vulnerabilities, now 16 CVEs assigned.
4 critical:
- WebAuthn passkey injection → account takeover
- tenant admin self-promotes to GLOBAL_ADMIN
- unauth GLOBAL_ADMIN account creation
- staff crypto poisoning breaks the E2E recipient directory
rest: info disclosure, stored XSS, auth and IDOR bugs, all patched before public disclosure.