# CVE-2026-65825: OpenReception appointment booking software authentication bypass in PIN throttle

Source: https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-65825 · Severity: high · CVSS 7.5 · Published 2026-10-23

OpenReception's appointment booking platform uses a six-digit PIN to control access to clients' encrypted appointment data. A flaw in how the system manages rate-limiting across multiple customer organizations allows an attacker at one organization to disable PIN brute-force protections for clients at another organization, enabling rapid guessing of PINs and takeover of appointment access. An attacker can add, cancel, or view another client's appointments.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-65825 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65825 being exploited in the wild.

**How severe is CVE-2026-65825?** High severity, with a CVSS score of 7.5, published 23 October 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software 2.1.0 and prior.

**Is there a fix for CVE-2026-65825?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65825 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-65825?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The challenge_throttle table uses emailHash (tenant-independent) as its primary key but stores tenant_id as an unkeyed column. The recordFailedAttempt function writes failures with the caller's tenant ID but on conflict only updates attempt counts, leaving the row's tenant_id unchanged. checkThrottle reads throttle state scoped to the caller's tenant, so once tenant A owns a throttle record for an identifier, tenant B's checks never match, bypassing throttle enforcement. Combined with a weak six-digit PIN space (10^6) and a spoofable generic rate limiter, this enables online brute-force exhaustion in hours to days.

## Affected products

- OpenReception appointment-booking-software 2.1.0 and prior

## Timeline

- 2026-07-03: disclosed
- 2026-10-23: advisory

## References

- [https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v4q4-xmqf-gmq8](https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v4q4-xmqf-gmq8)

## Related threats

- [OpenReception Appointment Booking unauthenticated ML-KEM key injection](https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software invite token replay](https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception Appointment Booking Software authentication bypass in passkey enrollment](https://junglewise.ai/threats/cve-2026-54460-openreception-appointment-booking-software-authentication-bypass)