CVE-2026-75525: OpenReception Appointment Booking unauthenticated ML-KEM key injection

CVE-2026-75525 · Severity: medium · CVSS 5.3 · Published 2026-10-23

OpenReception's appointment booking platform encrypts sensitive patient appointment data end-to-end to staff members, with a guarantee that only authorized staff can read it. An unauthenticated attacker can inject a forged encryption key into any staff member's crypto directory, allowing them to decrypt all future appointments booked in that tenant. This breaks the core security model protecting patient data.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-75525 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75525 being exploited in the wild.
How severe is CVE-2026-75525?
Medium severity, with a CVSS score of 5.3, published 23 October 2026.
Which products and versions are affected?
OpenReception Appointment-Booking-Software 2.1.0 and prior.
Is there a fix for CVE-2026-75525?
No fixed version is recorded yet. Restrict network access to the /api/tenants/{id}/staff/{staffId}/crypto and /api/auth/challenge endpoints to authenticated sessions or trusted IP ranges until patched. Regularly audit staff_crypto table entries for unexpected or unrecognized ML-KEM public keys.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75525 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-75525?
Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict network access to the /api/tenants/{id}/staff/{staffId}/crypto and /api/auth/challenge endpoints to authenticated sessions or trusted IP ranges until patched. Regularly audit staff_crypto table entries for unexpected or unrecognized ML-KEM public keys.</anigation> </invoke>

Technical details

An unauthenticated attacker can exploit a missing validation in the /api/tenants/{id}/staff/{staffId}/crypto endpoint to inject an arbitrary ML-KEM-768 public key under any existing user's identity. The vulnerability stems from insufficient binding: a webauthn-registration-email cookie obtained via an unauthenticated /api/auth/challenge call is accepted without verification that it matches the target staff member, belongs to the target tenant, or is part of a valid registration session. The injected key becomes a persistent unauthorized recipient of tunnel keys for all future appointments in that tenant.

Affected products

  • OpenReception Appointment Booking Software 2.1.0 and prior

Timeline

  • 2026-07-08: disclosed
  • 2026-10-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.