The vulnerability in OpenReception appointment booking software (CVE-2026-48071) is due to improper restriction of excessive authentication attempts (CWE-307). The PIN-type challenge throttle uses a shared key (emailHash) across all tenants in the central challenge_throttle table. This design flaw allows an attacker who knows a patient's email to lock out that patient on multiple tenants by triggering failed PIN challenges on any tenant. The lockout escalates with repeated failures, causing denial of service. The vulnerability affects all versions prior to 1.0.4, which includes the shared throttle mechanism. Version 1.0.4 patches this issue by presumably isolating throttle keys per tenant or otherwise fixing the shared state problem.

An attacker can cause a denial of service against a patient by locking them out of appointment booking across multiple tenants sharing the platform, without needing any relationship to the targeted tenant. The lockout durations escalate from 60 seconds up to 60 minutes with repeated failed attempts, potentially causing sustained denial of service. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade to OpenReception appointment booking software version 1.0.4 or later, where this issue is patched. The patch addresses the shared throttle key problem that allowed cross-tenant lockouts. No other mitigation is indicated or required.