CVE-2026-48071: OpenReception appointment booking cross-tenant rate limit bypass

CVE-2026-48071 · Severity: medium · CVSS 5.8 · Published 2026-08-06

OpenReception is an end-to-end encrypted appointment booking platform used by healthcare providers to manage patient appointments. A flaw in the PIN challenge throttling mechanism allows an attacker to lock out legitimate patients across different tenants sharing the same platform instance, causing service disruption without needing any relationship to the victim's clinic or permission to access their systems.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-48071 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48071 being exploited in the wild.
How severe is CVE-2026-48071?
Medium severity, with a CVSS score of 5.8, published 6 August 2026.
Which products and versions are affected?
OpenReception Appointment-Booking-Software <= 1.0.3.
Is there a fix for CVE-2026-48071?
A patch was published on 2026-05-08: Fix committed; version 1.0.4 addresses the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48071 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48071?
Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The PIN-type challenge throttle mechanism uses only `emailHash` as the throttle key, stored in a centralized `challenge_throttle` table shared across all tenants. The vulnerability occurs because both the `/api/tenants/{id}/appointments/challenge` (issuance) and `/api/tenants/{id}/appointments/verify-challenge` (validation) endpoints read and increment the same throttle row, without including tenant ID in the key. When the same email exists in multiple tenants on one OpenReception instance, an attacker can trigger failed challenges against tenant A to increment the shared throttle row, causing denial of service against the same email in tenant B. No prior relationship or authentication with tenant B is required. The throttle escalates: 4 failed attempts trigger a ~60-second lockout; subsequent bursts lock out for 5, 30, and 60 minutes, enabling sustained DoS. Versions up to 1.0.3 are affected; version 1.0.4 patches the vulnerability by including tenant ID in the throttle key.

Affected products

  • OpenReception appointment-booking-software <= 1.0.3

Timeline

  • 2026-05-20: disclosed: GitHub Security Advisory GHSA-f778-wf9x-3qf9 published
  • 2026-08-06: advisory: CVE-2026-48071 published in NVD
  • 2026-05-08: patched: Fix committed; version 1.0.4 addresses the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.