OpenReception audit reveals admin takeover and encryption bypass vulnerabilities
A security audit of the open-source, end-to-end encrypted appointment system OpenReception uncovered 16 CVEs, four critical, including unauthenticated global admin creation and a flaw that defeats its encryption model. The vulnerabilities gave attackers full control over tenant data and could let them impersonate any user, undermining the platform’s core privacy promise.