CVE-2026-48071 open-reception CVE debrief

Who should care

Defenders responsible for OpenReception's appointment booking software, particularly those managing tenant configurations and software updates, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-48071 allows an attacker to lock out patients on one tenant by exploiting the shared challenge throttle table across all tenants, leading to potential denial of service and lockout escalation.

• Denial of service against targeted email addresses
• Lockout escalation with repeated failures
• Potential for sustained denial of service with repeated bursts

Technical summary

The vulnerability exists in OpenReception's appointment booking software prior to version 1.0.4. The PIN-type challenge throttle uses `emailHash` as the only key, and the throttle rows live in the central `challenge_throttle` table, which is shared across all tenants. This allows an attacker to lock out a patient on one tenant by issuing failed challenge responses against another tenant. The lockout escalates with repeated failures, triggering at 4 failed attempts and lasting 60 seconds initially, then escalating to 5 minutes, 30 minutes, and 60 minutes per the throttle service's escalation logic.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.0.4 of the appointment booking software, and review tenant configurations to prevent similar issues.

Recommended defensive actions

• Verify and upgrade to version 1.0.4 of the appointment booking software
• Review tenant configurations to prevent similar issues
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the patched version. However, additional information on potential exploitation and affected systems is limited. The vulnerability allows an attacker to lock out patients on one tenant by exploiting the shared challenge throttle table across all tenants, leading to potential denial of service and lockout escalation. The PIN-type challenge throttle uses `emailHash` as the only key, and the throttle rows live in the central `challenge_throttle` table, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.