CVE-2026-48076

Received Received - Intake

Appointment Booking Token Bypass in OpenReception

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48076

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenReception's appointment booking software versions 1.0.1 and prior. It allows an attacker to create appointments in private channels by exploiting missing validation in the booking flow. The token issued during the booking process does not bind to channelId, and the system fails to check if a channel is private before allowing appointments. This enables unauthorized access to private channels.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to private channels via the appointment booking flow. Monitor logs for unusual `create-new-client` requests with `channelId` values not listed in public channels. Verify if `bootstrap-verify` tokens are issued without proper `channelId` binding. Check for GET requests to `/api/public/channels` returning private channel IDs.

Impact Analysis

If you use OpenReception's software, attackers could create appointments in your private channels without authorization. This could lead to unauthorized access to sensitive information, disruption of services, or misuse of your booking system. The attack is feasible with minimal effort due to low PoW difficulty and no rate limiting.

Compliance Impact

This vulnerability could lead to unauthorized access to private channels, potentially exposing sensitive personal or health data. This may violate GDPR's data protection requirements or HIPAA's privacy and security rules, depending on the data processed. Organizations using this software may face compliance violations and legal consequences.

Mitigation Strategies

Disable the new-client booking flow until a patch is available. Implement rate limiting on `bootstrap-challenge` and `bootstrap-verify` endpoints. Add server-side validation to ensure tokens include `channelId` and enforce `isPublic` checks in `createNewClientWithAppointment`. Block unauthenticated access to `/api/public/channels`.

Hi! I’m here to help you understand CVE-2026-48076. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70