OpenReception appointment booking software versions 2.1.0 and earlier contain an authorization vulnerability allowing unauthenticated attackers to inject arbitrary encryption public keys into any tenant's staff recipient directory. This breaks the product's end-to-end encryption guarantee by enabling persistent unauthorized access to appointment encryption keys. No patches are publicly available at this time.
A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in OpenReception's appointment booking software prior to version 2.2.2. This flaw allows an attacker to overbook an agent by placing multiple appointments into a single time slot that should be exclusive. The issue arises because the booking token is consumed after insertion, but concurrent requests can still cause overlapping bookings. The vulnerability compromises the integrity of the booking calendar and can deny availability to other clients. It has been patched in version 2.2.2.
OpenReception's appointment booking software versions 2.1.0 and earlier contain a vulnerability that allows brute-forcing of a client's six-digit booking PIN. Successful brute force yields the client's booking access token, enabling access to their encrypted appointment data and the ability to act on their behalf within the appointment tunnel. The vulnerability involves improper restriction of excessive authentication attempts and includes a cross-tenant bypass that removes authentication protections across tenant boundaries. No patches are publicly available at this time.
OpenReception's appointment booking software prior to version 2.2.1 contains an authentication bypass vulnerability. An attacker who captures a pending invite token can replay it to register their own passkey on the invited account, gaining control of that account. If the invite is for a staff or tenant-admin, the attacker gains access to the tenant context associated with that account. This vulnerability has been patched in version 2.2.1.
OpenReception's appointment booking software versions prior to 2.0.0 contain a vulnerability in the password recovery mechanism where the account-confirmation link in emails is constructed from the unvalidated Host header. This allows an attacker to send a confirmation email with a malicious link that, if clicked by the invitee, enables the attacker to take over the account by confirming it and registering a passkey. The issue is patched in version 2.0.0.
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and does not bind enrollment to locals.user.id. An unauthenticated attacker who knows the public tenant ID and the target staff email can use the public booking bootstrap and GET /api/tenants/[id]/appointments/staff-public-keys to obtain candidate userId values. The attacker first causes UserService.addAdditionalPasskey to store a controlled public key for a candidate userId, then attempts login with the target email; the login check compares verificationResult.userId with the email-resolved account and reveals whether the injected credential belongs to that target. Repeating this injection-before-login sequence identifies the matching userId, and the normal login endpoint accepts the attacker's assertion for the stored key and creates a STAFF session. The session can expose tenant data and reveal TENANT_ADMIN identifiers for further takeover; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. A hijacked TENANT_ADMIN can modify or delete tenant resources and key shares, potentially making appointment data permanently undecryptable and taking booking services offline. This issue is fixed in version 1.1.1.
CVE-2026-48088 is a critical missing authorization vulnerability in OpenReception's appointment booking software prior to version 1.0.4. It allows unauthenticated attackers to store malicious encryption keys for any tenant, effectively registering themselves as encryption recipients for future patient appointments. This breaks the platform's end-to-end encryption guarantees, enabling attackers to decrypt appointment data. The vulnerability also includes a logging bypass variant that suppresses security warnings, and weak schema validation allows malformed entries that disrupt legitimate booking flows. Version 1.0.4 addresses this issue.
CVE-2026-48087 is a critical improper authentication vulnerability in OpenReception's appointment booking software prior to version 1.0.2. The flaw allows an unauthenticated attacker to register a WebAuthn passkey credential under a victim's user ID by exploiting insufficient validation between the userId in the URL and the email associated with the registration cookie. This enables the attacker to impersonate the victim and gain unauthorized access. The issue is fixed in version 1.0.2.
CVE-2026-48086 is a critical privilege escalation vulnerability in OpenReception's appointment booking software prior to version 1.0.2. A tenant administrator (TENANT_ADMIN) can promote themselves or another tenant staff member to platform-wide GLOBAL_ADMIN via a single PUT request due to lack of proper authorization checks. This allows full administrative control over all tenants on the platform, including configuration, users, and tenant lifecycle management. The issue is fixed in version 1.0.2.
OpenReception appointment booking software versions prior to 1.0.1 contain a critical missing authorization vulnerability. An unauthenticated attacker can create additional global admin accounts via POST requests to the /setup/create-admin-account endpoint, bypassing the intended setup page guard. These admin accounts are created active and usable immediately without email confirmation. This flaw persists even after the instance has been claimed and configured, allowing full platform-level administrative control without authentication.
OpenReception's appointment booking software versions prior to 1.0.2 do not throttle failed passphrase login attempts, allowing attackers to perform unlimited guesses against known email addresses. This lack of throttling applies only to the passphrase login path, while the WebAuthn path is properly rate-limited. The vulnerability enables credential stuffing and dictionary attacks, especially against accounts with common or weak passphrases. Version 1.0.2 addresses this issue by implementing throttling on the passphrase login attempts.
OpenReception's appointment booking software prior to version 1.0.2 contains a vulnerability in its /api/log endpoint that allows unauthenticated attackers to inject arbitrary log entries. This endpoint accepts POST requests without authentication or schema validation and writes attacker-controlled content directly to application logs. This can lead to log injection, denial of service via log volume saturation, and oversized payload submissions. Version 1.0.2 addresses this issue.
OpenReception's appointment booking software prior to version 1.0.6 has a weakness in its rate-limiting mechanism for unauthenticated clients. The proof-of-work challenge used as a rate limiter is set to a difficulty level that modern hardware can solve very quickly, making it ineffective against automated abuse. Additionally, the throttle mechanism can be bypassed by attackers supplying attacker-controlled values, allowing them to evade per-binding throttling. Version 1.0.6 addresses this issue.
OpenReception appointment booking software versions prior to 1.0.2 contain a cross-site scripting (XSS) vulnerability. A TENANT_ADMIN can configure tenant links with javascript: URLs that are rendered without proper filtering on the patient-facing landing page. This allows execution of arbitrary JavaScript in the patient's browser, exposing plaintext patient form data before client-side encryption. Version 1.0.2 addresses this issue.
OpenReception appointment booking software versions prior to 1.0.2 have an insufficient session expiration vulnerability. When users log out via the /logout page, the session revocation is not properly executed due to a server-side ordering error, leaving the session valid until its natural expiry. This allows an attacker with a copied access token to continue making authenticated API calls despite the user seeing a successful logout. The issue is fixed starting with version 1.0.2, which correctly revokes the session before deleting authentication cookies.
OpenReception appointment booking software versions prior to 1.0.5 contain a vulnerability where an unauthenticated API endpoint discloses sensitive information about private channels. The /api/tenants/{id}/schedule endpoint returns details of all non-archived channels regardless of their intended visibility, exposing channel names, descriptions, IDs, agent associations, and availability. This issue is fixed in version 1.0.5.
OpenReception appointment booking software versions prior to 1.1.0 contain a missing authorization check in the GET handler for fetching appointment records. This flaw allows any party with a valid appointment UUID to retrieve sensitive appointment details without authentication. The issue is fixed in version 1.1.0.
CVE-2026-48076 is an authorization vulnerability in OpenReception's appointment booking software versions 1.0.1 and earlier. The flaw allows an attacker to create new client appointments in private channels without proper authorization because the booking access token does not bind to the channel ID, and the private channel check is missing in the new-client booking flow. Private channel IDs can be enumerated via an unauthenticated endpoint, enabling anonymous attackers to book appointments in channels intended to be private. No patches or official fixes are currently available.
OpenReception appointment booking software versions prior to 1.0.5 contain a missing authorization vulnerability in the `add-to-tunnel` endpoint. This endpoint allows unauthenticated creation of confirmed appointments in arbitrary client tunnels by supplying any valid tunnelId and emailHash. The vulnerability arises because the endpoint only checks for the existence of the emailHash but does not authenticate the caller as the owner of the tunnelId. Version 1.0.5 addresses this issue.
OpenReception appointment booking software versions prior to 1.0.6 contain an authorization flaw where deleting a staff user by a TENANT_ADMIN improperly deletes pending invites across tenants sharing the same email. This occurs because the invite cleanup query lacks tenant scoping, allowing cross-tenant invite deletion. The issue is fixed in version 1.0.6.