Executive brief
OpenReception is an end-to-end encrypted appointment booking platform used by healthcare providers to manage patient appointments. A flaw in the PIN challenge throttling mechanism allows an attacker to lock out legitimate patients across different tenants sharing the same platform instance, causing service disruption without needing any relationship to the victim's clinic or permission to access their systems.
Technical details
The PIN-type challenge throttle mechanism uses only `emailHash` as the throttle key, stored in a centralized `challenge_throttle` table shared across all tenants. The vulnerability occurs because both the `/api/tenants/{id}/appointments/challenge` (issuance) and `/api/tenants/{id}/appointments/verify-challenge` (validation) endpoints read and increment the same throttle row, without including tenant ID in the key. When the same email exists in multiple tenants on one OpenReception instance, an attacker can trigger failed challenges against tenant A to increment the shared throttle row, causing denial of service against the same email in tenant B. No prior relationship or authentication with tenant B is required. The throttle escalates: 4 failed attempts trigger a ~60-second lockout; subsequent bursts lock out for 5, 30, and 60 minutes, enabling sustained DoS. Versions up to 1.0.3 are affected; version 1.0.4 patches the vulnerability by including tenant ID in the throttle key.
Affected products
- OpenReception appointment-booking-software <= 1.0.3
Timeline
- 2026-05-20: disclosed: GitHub Security Advisory GHSA-f778-wf9x-3qf9 published
- 2026-08-06: advisory: CVE-2026-48071 published in NVD
- 2026-05-08: patched: Fix committed; version 1.0.4 addresses the vulnerability