These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:11.893Z and has not been modified since then. OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-KEM-768 [truncated]
OpenReception's appointment booking software has a critical vulnerability (CVE-2026-48087) with a CVSS score of 9.8. The vulnerability exists in the registration handler at `POST /api/auth/register/{userId}`, where the software validates the relationship between the WebAuthn challenge and the registration cookie's email but never validates that the `userId` in the URL belongs to that email. This allows an [truncated]
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts the `GLOBAL_ADMIN` enum value from any tenant admin updating their own tenant's staff. No policy check enforces that only an existing GLOBAL_ADMIN ma [truncated]
The CVE-2026-48085 vulnerability affects OpenReception's appointment booking software, specifically versions prior to 1.0.1. This critical vulnerability allows unauthenticated POST requests to /setup/create-admin-account, creating additional GLOBAL_ADMIN accounts without verifying that an admin already exists. The vulnerability provides full platform-level administrative control to an attacker. The issue [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:11.297Z and has not been modified since then. OpenReception's appointment booking software has a vulnerability in versions prior to 1.0.2, allowing unlimited failed passphrase login attempts due to a lack of throttling. This oversight enables credential stuffing and dictionary attacks, maki [truncated]
OpenReception's appointment booking software has a log injection vulnerability prior to version 1.0.2. The /api/log endpoint accepts unauthenticated POST requests and writes attacker-controlled content directly into the application's stdout log. This allows for log injection attacks, which can be used to forge log lines that look like legitimate system events, mask attacker activity, or pollute SIEM alert [truncated]
OpenReception's appointment booking software has a vulnerability in its proof-of-work challenge endpoint, which can be bypassed due to low difficulty, allowing for potential abuse of the patient booking flow. The affected product or component is OpenReception's appointment booking software. The vulnerability class is related to proof-of-work challenge endpoints. The likely operational impact is related to [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:10.703Z and has not been modified since then. OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint returns the full tenant record to any authenticated `TENANT_ADMIN` of that t [truncated]
OpenReception's appointment booking software has a vulnerability in its logout functionality, CVE-2026-48079. The issue arises when a user navigates to the /logout page; the server-side load handler deletes the access_token cookie before calling /api/auth/logout. This causes the internal fetch to run without the auth cookie, leading to the logout handler not executing and SessionService.revokeSession() no [truncated]
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/tenants/{id}/schedule` endpoint returns every non-archived channel for a tenant regardless of the channel's `isPublic` flag. Channels marked `isPublic = false` are intended to be invisible to public callers; the dashboard creates them deliberately to [truncated]
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge`, `bootstrap-verify`, and `create-new-client`. The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request sc [truncated]
CVE-2026-48075 is a MEDIUM-severity vulnerability in OpenReception's appointment booking software. The add-to-tunnel endpoint allows an unauthenticated attacker to create a new appointment row in any client tunnel. This vulnerability has significant implications for the security of client tunnels and appointment data. Users of OpenReception's appointment booking software, administrators of client tunnels, [truncated]
OpenReception's appointment booking software has a vulnerability in versions prior to 1.0.6, allowing unintended deletion of invites across tenants when a TENANT_ADMIN deletes a staff user. This occurs because the `email` clause in the invite cleanup lacks a `tenantId` predicate. The vulnerability has a CVSS score of 2.7 and LOW severity. To mitigate, apply version 1.0.6 or later and verify administrative [truncated]
OpenReception's appointment booking software, prior to version 1.0.4, contains a vulnerability in its PIN-type challenge throttle. The throttle uses `emailHash` as the sole key, which is shared across all tenants. This setup allows an attacker to lock out a patient on one tenant by issuing failed challenge responses against another tenant sharing the platform, leading to a denial-of-service attack against [truncated]
