CVE-2026-48082

Received Received - Intake

Proof-of-Work Bypass in OpenReception Booking Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/api/tenants/{id}/appointments/bootstrap-challenge` issues a SHA-256 proof-of-work with `difficulty=4` hex zeros, equivalent to 16 bits of work. Modern hardware solves this in under 200 milliseconds, providing essentially no friction against automated abuse of the patient booking flow. Proof-of-work is used in the booking flow as a rate-limiter for unauthenticated clients establishing tunnels and submitting appointments. At 16 bits of difficulty, the construct is decorative rather than effective. An attacker can solve PoW challenges as fast as the server can issue them, defeating the rate-limiting purpose. The handler also calls `challengeThrottleService.checkThrottle(binding, "passkey")`, but the binding includes attacker-controlled values (`tunnelId`, `clientPublicKey`, and optional `emailHash`). For each fresh attempt, the attacker can supply new values, producing a new throttle key and bypassing the per-binding accumulation. Practical abuse friction is therefore the PoW difficulty itself, not a stable per-IP or per-email server-side throttle. Version 1.0.6 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48082

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.0.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is in OpenReception's appointment booking software before version 1.0.6. It uses a weak proof-of-work (PoW) system with only 16 bits of difficulty to rate-limit unauthenticated booking requests. The PoW is too easy to solve, allowing attackers to bypass rate limits by quickly generating new challenges with attacker-controlled values like tunnelId and clientPublicKey.

Detection Guidance

Detecting this vulnerability requires checking if your OpenReception software version is below 1.0.6. Inspect the software version via package managers or application logs. Monitor network traffic for excessive requests to the `/api/tenants/{id}/appointments/bootstrap-challenge` endpoint, which may indicate automated abuse.

Impact Analysis

Attackers can abuse the booking system to submit appointments rapidly, overwhelming the server or spamming the system. This could lead to denial-of-service, wasted resources, or disruption of legitimate bookings. The weak PoW provides no meaningful protection against automated abuse.

Mitigation Strategies

Upgrade OpenReception's appointment booking software to version 1.0.6 or later to address the insufficient proof-of-work rate-limiting mechanism. Ensure the fix is applied across all instances to prevent automated abuse of the booking flow.

Hi! I’m here to help you understand CVE-2026-48082. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70