Threat Intelligence Database

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and does not bind enrollment to locals.user.id. An unauthenticated attacker who knows the public tenant ID and the target staff email can use the public booking bootstrap and GET /api/tenants/[id]/appointments/staff-public-keys to obtain candidate userId values. The attacker first causes UserService.addAdditionalPasskey to store a controlled public key for a candidate userId, then attempts login with the target email; the login check compares verificationResult.userId with the email-resolved account and reveals whether the injected credential belongs to that target. Repeating this injection-before-login sequence identifies the matching userId, and the normal login endpoint accepts the attacker's assertion for the stored key and creates a STAFF session. The session can expose tenant data and reveal TENANT_ADMIN identifiers for further takeover; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. A hijacked TENANT_ADMIN can modify or delete tenant resources and key shares, potentially making appointment data permanently undecryptable and taking booking services offline. This issue is fixed in version 1.1.1.

CVE-2026-48088 is a critical missing authorization vulnerability in OpenReception's appointment booking software prior to version 1.0.4. It allows unauthenticated attackers to store malicious encryption keys for any tenant, effectively registering themselves as encryption recipients for future patient appointments. This breaks the platform's end-to-end encryption guarantees, enabling attackers to decrypt appointment data. The vulnerability also includes a logging bypass variant that suppresses security warnings, and weak schema validation allows malformed entries that disrupt legitimate booking flows. Version 1.0.4 addresses this issue.

CVE-2026-48087 is a critical improper authentication vulnerability in OpenReception's appointment booking software prior to version 1.0.2. The flaw allows an unauthenticated attacker to register a WebAuthn passkey credential under a victim's user ID by exploiting insufficient validation between the userId in the URL and the email associated with the registration cookie. This enables the attacker to impersonate the victim and gain unauthorized access. The issue is fixed in version 1.0.2.

CVE-2026-48086 is a critical privilege escalation vulnerability in OpenReception's appointment booking software prior to version 1.0.2. A tenant administrator (TENANT_ADMIN) can promote themselves or another tenant staff member to platform-wide GLOBAL_ADMIN via a single PUT request due to lack of proper authorization checks. This allows full administrative control over all tenants on the platform, including configuration, users, and tenant lifecycle management. The issue is fixed in version 1.0.2.

OpenReception appointment booking software versions prior to 1.0.1 contain a critical missing authorization vulnerability. An unauthenticated attacker can create additional global admin accounts via POST requests to the /setup/create-admin-account endpoint, bypassing the intended setup page guard. These admin accounts are created active and usable immediately without email confirmation. This flaw persists even after the instance has been claimed and configured, allowing full platform-level administrative control without authentication.

OpenReception's appointment booking software versions prior to 1.0.2 do not throttle failed passphrase login attempts, allowing attackers to perform unlimited guesses against known email addresses. This lack of throttling applies only to the passphrase login path, while the WebAuthn path is properly rate-limited. The vulnerability enables credential stuffing and dictionary attacks, especially against accounts with common or weak passphrases. Version 1.0.2 addresses this issue by implementing throttling on the passphrase login attempts.

OpenReception's appointment booking software prior to version 1.0.2 contains a vulnerability in its /api/log endpoint that allows unauthenticated attackers to inject arbitrary log entries. This endpoint accepts POST requests without authentication or schema validation and writes attacker-controlled content directly to application logs. This can lead to log injection, denial of service via log volume saturation, and oversized payload submissions. Version 1.0.2 addresses this issue.

OpenReception's appointment booking software prior to version 1.0.6 has a weakness in its rate-limiting mechanism for unauthenticated clients. The proof-of-work challenge used as a rate limiter is set to a difficulty level that modern hardware can solve very quickly, making it ineffective against automated abuse. Additionally, the throttle mechanism can be bypassed by attackers supplying attacker-controlled values, allowing them to evade per-binding throttling. Version 1.0.6 addresses this issue.

OpenReception appointment booking software versions prior to 1.0.2 contain a cross-site scripting (XSS) vulnerability. A TENANT_ADMIN can configure tenant links with javascript: URLs that are rendered without proper filtering on the patient-facing landing page. This allows execution of arbitrary JavaScript in the patient's browser, exposing plaintext patient form data before client-side encryption. Version 1.0.2 addresses this issue.

OpenReception appointment booking software versions prior to 1.0.2 have an insufficient session expiration vulnerability. When users log out via the /logout page, the session revocation is not properly executed due to a server-side ordering error, leaving the session valid until its natural expiry. This allows an attacker with a copied access token to continue making authenticated API calls despite the user seeing a successful logout. The issue is fixed starting with version 1.0.2, which correctly revokes the session before deleting authentication cookies.