Cybersecurity on moltenbit

Auditing OpenReception: 16 CVEs in an end-to-end encrypted appointment booking platform

Tue, 30 Jun 2026 00:00:00 +0200

OpenReception is an open-source appointment booking platform aimed at medical practices, with a self-hosted edition and a commercially hosted multi-tenant version. Its 1.0 release was covered as an open-source alternative to commercial schedulers like Doctolib by heise and Golem. Its selling point is end-to-end encryption: patient data is supposed to stay readable only to the staff it is meant for, while the server holds ciphertext it cannot decrypt. A single instance can host many independent practices, and it ships as a SvelteKit application backed by PostgreSQL.

I audited the released code shortly after the 1.0 line shipped and ran a local instance from the official docker-compose to validate findings. Over the audit I reported 16 vulnerabilities. All of them were assigned CVEs, four were rated Critical, and all were fixed before public disclosure on 2026-05-20.

Two of the four hand an attacker full administrative control, one lets them log in as anyone, and the last quietly defeats the encryption the whole product is built on.

Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)

Wed, 08 Apr 2026 12:00:00 +0100

Zammad 7.0 shipped in March 2026 with a set of new AI features, including customizable “text tools” that let agents use LLM-powered writing assistance within tickets. Admins can restrict these tools to specific groups, so only the Sales team gets the Sales prompt, and so on.

I audited the 7.0 codebase shortly after release and found two independent authorization failures in the REST endpoint used to execute AI text tools. One bug let an agent invoke tools outside their allowed group scope. The second let the same endpoint resolve unauthorized context objects into the prompt template. As a result, data from tickets outside the agent’s access scope could end up in the AI prompt and potentially in the returned model output.

Zammad patched this in 7.0.1. The findings resulted in two CVEs: CVE-2026-34782 for the text tool authorization bypass and CVE-2026-34837 for the context data IDOR.

A third finding from the same audit, a CSRF in OAuth callback endpoints (CVE-2026-34721), was also patched in 7.0.1 and backported to 6.5.4, but is not covered in this post.

Bypassing Wazuh's UNC Mitigation in Windows OSQuery via \\?\UNC\ (CVE-2025-30201 / GHSA-x697-jf34-gp5x)

Tue, 17 Mar 2026 12:00:00 +0100

Wazuh mitigated a NetNTLMv2 hash leakage (CVE-2025-30201 / GHSA-x697-jf34-gp5x) issue caused by allowing classic UNC paths (e.g., \\server\share) in centrally managed Windows agent configuration. The core risk is that when a attacker controlled domain-joined Windows agent accesses a remote SMB path, Windows may perform NTLM authentication to that server, allowing an attacker to capture the machine account’s NetNTLMv2 hash.

In follow-up testing on Wazuh 4.14.1, I found that the mitigation could still be bypassed in the OSQuery configuration: classic UNC paths were blocked, but extended-length UNC paths using the \\?\UNC\ prefix were accepted for OSQuery’s log_path and config_path.

The CVE has seen bince been extended to cover the bypass.

Detecting the Notepad++ Supply Chain Attack: A PowerShell Triage Script

Wed, 04 Feb 2026 12:00:00 +0100

A PowerShell-based triage script to check systems for indicators of compromise related to the Notepad++ supply chain attack attributed to Lotus Blossom APT.