I audited #OpenReception, a recently released open-source appointment booking platform. Found and reported 16 vulnerabilities, now 16 CVEs assigned. 4 critical: - WebAuthn passkey injection → account takeover - tenant admin self-promotes to GLOBAL_ADMIN - unauth GLOBAL_ADMIN account creation - staff crypto poisoning breaks the E2E recipient directory rest: info disclosure, stored XSS, auth and IDOR bugs, all patched before public disclosure. https://moltenbit.net/disclosures/ #infosec #security #CVE