Denial of Service in OpenReception via Shared PIN Throttle

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses `emailHash` as the only key. The throttle rows live in the central `challenge_throttle` table, which is shared across all tenants. Every tenant's `/api/tenants/{id}/appointments/verify-challenge` endpoint increments the same row when a PIN response fails, and every tenant's `/api/tenants/{id}/appointments/challenge` endpoint reads the same row when deciding whether to issue a new challenge. When the same `emailHash` exists in multiple tenants on the same OpenReception instance (the same patient holding tunnels in two different clinics that share the platform), an attacker who knows the patient's email can lock out that patient on tenant B by issuing failed challenge responses against tenant A. The attacker needs no relationship to tenant B; the lockout propagates through the shared throttle row. The lockout escalates with repeated failures. The first lockout triggers at 4 failed attempts and lasts approximately 60 seconds. Subsequent failures escalate the lockout duration to 5 minutes, 30 minutes, and 60 minutes per the throttle service's escalation logic. Repeated bursts produce sustained denial of service against the targeted email. Version 1.0.4 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48071

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	1.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenReception's appointment booking software before version 1.0.4. It involves a shared throttle mechanism that uses emailHash as the only key in a central table. When a patient's email exists in multiple tenants, an attacker can lock out that patient on one tenant by sending failed PIN responses on another tenant. The lockout duration escalates with repeated attempts, causing a denial of service.

Impact Analysis

If you are a patient using OpenReception's software, an attacker could lock you out of your appointments by exploiting this flaw. This could prevent you from booking or verifying appointments, disrupting your access to healthcare services. The lockout can last up to 60 minutes per escalation tier.

Mitigation Strategies

Upgrade OpenReception's appointment booking software to version 1.0.4 or later to patch the shared throttle row issue affecting PIN-type challenge verification.

Hi! I’m here to help you understand CVE-2026-48071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70