CVE-2026-48088 open-reception CVE debrief

Who should care

Defenders responsible for OpenReception's appointment booking software deployments should assess exposure and prioritize remediation to prevent potential decryption of appointment payloads by unauthenticated attackers.

Why it matters

CVE-2026-48088 is a critical vulnerability in OpenReception's appointment booking software, allowing unauthenticated attackers to store malicious ML-KEM-768 public keys, potentially leading to decryption of appointment payloads. Defenders should prioritize verifying exposure and assessing potential impact, focusing on unauthenticated network attackers and ensuring version 1.0.4 is deployed.

• Unauthenticated attackers can store malicious ML-KEM-768 public keys, potentially leading to decryption of appointment payloads.
• The vulnerability allows attackers to register themselves as additional encryption recipients for any tenant's future patient appointments.
• Successful exploitation enables attackers to decapsulate the tunnel key and decrypt appointment payloads.
• Remediation priority is high due to the critical CVSS score and potential impact on sensitive information.

Technical summary

CVE-2026-48088 is a critical vulnerability in OpenReception's appointment booking software, allowing unauthenticated attackers to store malicious ML-KEM-768 public keys, potentially leading to decryption of appointment payloads. The vulnerability arises from the software's failure to properly authenticate requests to store ML-KEM-768 public keys, which can be exploited by attackers to register themselves as additional encryption recipients for any tenant's future patient appointments. This can enable attackers to decapsulate the tunnel key and decrypt appointment payloads. The vulnerability has a critical CVSS score of 9.4 and affects OpenReception's appointment booking software prior to version 1.0.4.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on unauthenticated network attackers and ensuring version 1.0.4 is deployed.

Recommended defensive actions

• Verify that all instances of OpenReception's appointment booking software are running version 1.0.4 or later.
• Assess exposure to unauthenticated network attackers and prioritize remediation accordingly.
• Review logs for suspicious activity related to the affected software.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.4 and the affected product, OpenReception's appointment booking software prior to version 1.0.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.