The vulnerability in OpenReception's appointment booking software involves improper restriction of excessive authentication attempts (CWE-307). The PIN challenge throttle uses emailHash as the sole key for throttling failed attempts, but the throttle data is shared across all tenants in a central table. This design flaw allows an attacker who knows a patient's email to lock out that patient across different tenants by triggering failed PIN attempts on any tenant sharing the platform. The lockout duration escalates with repeated failures, causing a denial of service against the targeted email. The issue is patched in version 1.0.4.

An attacker can cause a denial of service against a user by locking them out of the appointment booking system across multiple tenants sharing the platform. This lockout escalates in duration with repeated failed attempts, potentially preventing legitimate users from accessing their accounts for up to 60 minutes. There is no impact on confidentiality or integrity, only availability is affected.

Version 1.0.4 of OpenReception appointment booking software patches this issue. Users should upgrade to version 1.0.4 or later to remediate the vulnerability. No other mitigation guidance is provided or necessary.