Threats affecting pkg:github/open-reception/appointment-booking-software

OpenReception's appointment booking software versions prior to 1.0.4 have an issue with improper restriction of excessive authentication attempts. The software uses a shared throttle key based on emailHash across all tenants, causing failed authentication attempts in one tenant to affect others. This allows an attacker to cause denial of service by locking out a user across multiple tenants by repeatedly failing PIN challenges. The lockout durations escalate with repeated failures, lasting up to 60 minutes. The issue is patched in version 1.0.4.

OpenReception appointment-booking-software versions prior to 1.0.2 expose the full tenant database connection string to authenticated TENANT_ADMIN users via the GET /api/tenants/{id} endpoint. This connection string includes credentials with superuser privileges by default, allowing a TENANT_ADMIN to access and manipulate all tenant databases and the central administrative database, breaking tenant isolation. Version 1.0.2 addresses this issue.