# CVE-2026-48075: OpenReception appointment booking auth bypass in add-to-tunnel endpoint

Source: https://junglewise.ai/threats/cve-2026-48075-openreception-appointment-booking-auth-bypass-in-add-to-tunnel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48075 · Severity: medium · CVSS 6.5 · Published 2026-08-06

OpenReception's appointment booking platform allows clients to securely schedule appointments with end-to-end encryption. Before version 1.0.5, an attacker could forge appointments into any client's tunnel without authentication by supplying any valid tunnel ID and email hash, creating confirmed bookings with attacker-controlled dates, times, and assigned agents. This allows unauthorized access to appointment slots and could be used for appointment fraud or service disruption.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-48075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48075 being exploited in the wild.

**How severe is CVE-2026-48075?** Medium severity, with a CVSS score of 6.5, published 6 August 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software before 1.0.5.

**Is there a fix for CVE-2026-48075?** A patch was published on 2026-08-06: Version 1.0.5 fixes the authentication bypass Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48075 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48075?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the `add-to-tunnel` endpoint, which lacks any caller authentication (no session, Authorization header, or access token). The endpoint accepts a `tunnelId` and `emailHash` supplied by the attacker, validates only that some tunnel exists with the given `emailHash`, and then writes an appointment directly to the attacker-supplied `tunnelId` without verifying ownership. The endpoint is explicitly listed in the public-route allowlist despite being intended for return clients, whereas the analogous `create-new-client` endpoint correctly requires a Bearer bootstrap token. An attacker can craft requests to insert arbitrary appointments with attacker-controlled ciphertext fields, dates, durations, and agent assignments into any tunnel. The fix in version 1.0.5 adds proper authentication checks.

## Affected products

- OpenReception Appointment Booking Software before 1.0.5

## Timeline

- 2026-08-06: disclosed
- 2026-08-06: patched: Version 1.0.5 fixes the authentication bypass

## Related threats

- [OpenReception Appointment Booking unauthenticated ML-KEM key injection](https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software authentication bypass in PIN throttle](https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software invite token replay](https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)