CVE-2026-75524

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.

• CWE-367

• https://github.com/open-reception/appointment-booking-software/commit/73663288a8d4ad2ad31d897dc1f494ace2f0e452
• https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.2
• https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j
• https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j

Published

Oct 23, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75514BunkerWeb is an open-source, next-generation Web Application…5.9
• CVE-2026-75516The RabbitMQ Java client library allows Java and JVM-based a…8.7
• CVE-2026-75517Novu provides an API for sending notifications through multi…6.5
• CVE-2026-7552The Geo Mashup plugin for WordPress is vulnerable to authori…5.3
• CVE-2026-75520Domoticz is a free, open source home automation system for L…5.4
• CVE-2026-75523Steeltoe is an open source project that provides a collectio…5.9
• CVE-2026-75525OpenReception's appointment booking software provides an end…5.3
• CVE-2026-75526django CMS is an easy-to-use and developer-friendly enterpri…4.4
• CVE-2026-75528The Broken Link Checker plugin for WordPress is vulnerable t…7.2
• CVE-2026-75529Pandora is affected by a stored cross-site scripting vulnera…6.9
• CVE-2026-7553A vulnerability was found in code-projects Gym Management Sy…4.7
• CVE-2026-75531Pandora contains a stored cross-site scripting (XSS) vulnera…7