--- cve: "CVE-2026-65824" severity: "HIGH" cvss: 7.4 epss: "0.4%" vendor: "open-reception" kev: false exploited: false published: "2026-10-23 20:27:52" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-10-26T21:13:29+01:00" --- # CVE-2026-65824 > 7.4 HIGH · 🧪 PoC ## Beschreibung OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1. ## CNA-Record (Kanon, cvelistV5) - CNA: **GitHub_M** - State: PUBLISHED - Stand: 2026-10-23 20:27:52 - CNA-CVSS: **7.4** (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`) ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Hoch | good | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Hoch | bad | | I Integrität | Hoch | bad | | A Verfügbarkeit | Keine | good | ## Schwachstellen-Klasse - **CWE-294** — Authentication Bypass by Capture-replay A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). ## Angriffsmuster (CAPEC) - [CAPEC-60 — Reusing Session IDs (aka Session Replay)](https://capec.mitre.org/data/definitions/60.html) _(Severity: High)_ - [CAPEC-102 — Session Sidejacking](https://capec.mitre.org/data/definitions/102.html) _(Severity: High)_ - [CAPEC-509 — Kerberoasting](https://capec.mitre.org/data/definitions/509.html) _(Severity: High)_ - [CAPEC-555 — Remote Services with Stolen Credentials](https://capec.mitre.org/data/definitions/555.html) _(Severity: Very High)_ - [CAPEC-561 — Windows Admin Shares with Stolen Credentials](https://capec.mitre.org/data/definitions/561.html) - [CAPEC-644 — Use of Captured Hashes (Pass The Hash)](https://capec.mitre.org/data/definitions/644.html) _(Severity: High)_ - [CAPEC-645 — Use of Captured Tickets (Pass The Ticket)](https://capec.mitre.org/data/definitions/645.html) _(Severity: High)_ - [CAPEC-652 — Use of Known Kerberos Credentials](https://capec.mitre.org/data/definitions/652.html) _(Severity: High)_ ## ATT&CK-Techniken - [T1134.001 — Access Token Manipulation:Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001/) - [T1550.004 — Use Alternate Authentication Material:Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/) - [T1558.003 — Steal or Forge Kerberos Tickets:Kerberoasting](https://attack.mitre.org/techniques/T1558/003/) - [T1021 — Remote Services](https://attack.mitre.org/techniques/T1021/) - [T1114.002 — Email Collection:Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/) - [T1133 — External Remote Services](https://attack.mitre.org/techniques/T1133/) - [T1021.002 — Remote Services:SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002/) - [T1550.002 — Use Alternate Authentication Material:Pass The Hash](https://attack.mitre.org/techniques/T1550/002/) - [T1550.003 — Use Alternate Authentication Material:Pass The Ticket](https://attack.mitre.org/techniques/T1550/003/) - [T1558 — Steal or Forge Kerberos Tickets](https://attack.mitre.org/techniques/T1558/) ## Patch verfügbar (OSV) - fffc45a1d6ccc11bf94e493674def8d8fdc732d4 (Commit) - da921eb9d36953276577c0a6deb9267bfec03622 (Commit) ## Referenzen - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-65824/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_