CVE-2026-48071 open-reception CVE debrief

Who should care

Organizations using OpenReception's appointment booking software prior to version 1.0.4 should prioritize patching to prevent potential denial-of-service attacks. Security teams and administrators responsible for maintaining the software should be aware of the vulnerability and take immediate action to patch the system.

Technical summary

The PIN-type challenge throttle in OpenReception's appointment booking software prior to version 1.0.4 uses `emailHash` as the only key, allowing an attacker to lock out a patient on one tenant by issuing failed challenge responses against another tenant sharing the platform. This is possible because the throttle rows are shared across all tenants, enabling a denial-of-service attack against a targeted email. The lockout escalates with repeated failures, starting at 4 failed attempts and lasting approximately 60 seconds, 5 minutes, 30 minutes, and 60 minutes per the throttle service's escalation logic.

Defensive priority

CVE-2026-48071 is rated MEDIUM with a CVSS score of 5.8. Organizations using OpenReception's appointment booking software prior to version 1.0.4 should prioritize patching to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch OpenReception's appointment booking software to version 1.0.4 or later to prevent denial-of-service attacks.
• Review and update tenant configurations to ensure isolation of sensitive data.
• Monitor for suspicious activity on the `/api/tenants/{id}/appointments/verify-challenge` and `/api/tenants/{id}/appointments/challenge` endpoints.
• Verify that the patch has been successfully applied and test the updated software.
• Conduct a thorough review of the system to identify potential security gaps.
• Implement additional monitoring to detect similar vulnerabilities in the future.
• Document the incident response plan in case of a denial-of-service attack.

Evidence notes

The CVE description details a vulnerability in OpenReception's appointment booking software prior to version 1.0.4. The PIN-type challenge throttle uses `emailHash` as the only key, allowing an attacker to lock out a patient on one tenant by issuing failed challenge responses against another tenant sharing the platform. The throttle rows are shared across all tenants, enabling a denial-of-service attack against a targeted email. Version 1.0.4 patches the issue.

Official resources