OpenReception’s appointment booking software allows an attacker who obtains a pending invite token to replay it within its validity period, causing the system to issue a registration‑bootstrap cookie that permits the attacker to register a passkey on the invited account. This process effectively transfers control of that account to the attacker. The vulnerability is due to improper handling of authentication tokens, identified as CWE-294. Should the invite target a staff or tenant‑admin role, the attacker also gains administrative access to the tenant context associated with that account.

This flaw affects installations of OpenReception appointment booking software running any version earlier than 2.2.1. Versions 2.2.1 and later contain the patch that disables replay of invite tokens.

The CVSS score of 7.4 indicates high severity. The EPSS score is not available, so exact exploitation likelihood is unknown, but the vulnerability can be abused if an attacker can capture or trick the recipient into providing a valid invite token before it expires. It is not listed in the CISA KEV catalog, suggesting no publicly known exploits are documented. Based on the description, it is inferred that the attacker would need to intercept the token or coerce the recipient into disclosing it, after which the replay can occur within the token’s validity window to take over the account.