# CVE-2026-75525: OpenReception Appointment Booking unauthenticated ML-KEM key injection

Source: https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-75525 · Severity: medium · CVSS 5.3 · Published 2026-10-23

OpenReception's appointment booking platform encrypts sensitive patient appointment data end-to-end to staff members, with a guarantee that only authorized staff can read it. An unauthenticated attacker can inject a forged encryption key into any staff member's crypto directory, allowing them to decrypt all future appointments booked in that tenant. This breaks the core security model protecting patient data.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-75525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75525 being exploited in the wild.

**How severe is CVE-2026-75525?** Medium severity, with a CVSS score of 5.3, published 23 October 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software 2.1.0 and prior.

**Is there a fix for CVE-2026-75525?** No fixed version is recorded yet. Restrict network access to the /api/tenants/{id}/staff/{staffId}/crypto and /api/auth/challenge endpoints to authenticated sessions or trusted IP ranges until patched. Regularly audit staff_crypto table entries for unexpected or unrecognized ML-KEM public keys.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75525 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75525?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict network access to the /api/tenants/{id}/staff/{staffId}/crypto and /api/auth/challenge endpoints to authenticated sessions or trusted IP ranges until patched. Regularly audit staff_crypto table entries for unexpected or unrecognized ML-KEM public keys.</anigation>
</invoke>

## Technical details

An unauthenticated attacker can exploit a missing validation in the /api/tenants/{id}/staff/{staffId}/crypto endpoint to inject an arbitrary ML-KEM-768 public key under any existing user's identity. The vulnerability stems from insufficient binding: a webauthn-registration-email cookie obtained via an unauthenticated /api/auth/challenge call is accepted without verification that it matches the target staff member, belongs to the target tenant, or is part of a valid registration session. The injected key becomes a persistent unauthorized recipient of tunnel keys for all future appointments in that tenant.

## Affected products

- OpenReception Appointment Booking Software 2.1.0 and prior

## Timeline

- 2026-07-08: disclosed
- 2026-10-23: advisory

## References

- [https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qc72-9fg9-h66h](https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qc72-9fg9-h66h)

## Related threats

- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software authentication bypass in PIN throttle](https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software invite token replay](https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception Appointment Booking Software authentication bypass in passkey enrollment](https://junglewise.ai/threats/cve-2026-54460-openreception-appointment-booking-software-authentication-bypass)