CVE-2026-65825 in Appointment Booking Software
Summary
by MITRE • 10/24/2026
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in OpenReception's appointment booking software represents a critical failure in access control mechanisms that allows an attacker to bypass authentication protections through a cross-tenant state manipulation technique. In versions 2.1.0 and prior, the system relies on a six-digit numeric PIN for returning clients to authenticate their identity within the platform. While this method provides convenience, it lacks sufficient entropy to resist brute-force attacks when implemented without adequate rate limiting or account lockout policies. The core technical flaw lies in how the application handles session state across different tenant boundaries. Specifically, the system fails to properly isolate client-specific authentication states, allowing a returning client's booking PIN from one tenant context to be used against another tenant's infrastructure. This architectural weakness enables an attacker to exploit the lack of strict boundary enforcement between isolated customer environments.
The operational impact of this vulnerability is severe due to its cross-tenant nature and the sensitivity of the data involved. A successful brute-force attack on the six-digit PIN yields a valid booking access token for the victim tenant's client. This token grants unauthorized access to the client's appointment tunnel, which serves as the container for end-to-end encrypted appointment data. Although the data is encrypted at rest or in transit using strong cryptographic standards, the vulnerability allows an attacker to act as the legitimate client within that secure channel. Consequently, the attacker can view sensitive personal information associated with appointments and, more critically, manipulate booking records by adding new appointments or cancelling existing ones. This capability undermines the integrity of the scheduling system and compromises the confidentiality of user data despite the presence of encryption layers designed to protect it.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify the identity of users attempting to access resources. Furthermore, the cross-tenant aspect where state owned by one tenant removes authentication protection for another is indicative of CWE-359 Exposure of Private Information Within a Single Tenant or more broadly CWE-601 URL Redirection to Untrusted Site via State Manipulation if viewed through the lens of session hijacking and context confusion. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials obtained through brute force or other means to gain access. The specific mechanism of exploiting cross-tenant state leakage also reflects aspects of T1534 Internal Spearphishing if the attack vector involves social engineering combined with technical exploitation, though primarily it is a direct application layer exploit related to session management flaws.
Mitigation strategies must address both the immediate cryptographic weakness and the broader architectural flaw regarding tenant isolation. The most effective short-term mitigation is to implement strict rate limiting on the PIN verification endpoint to prevent online brute-force attacks within reasonable timeframes. Additionally, enforcing account lockout policies after a small number of failed attempts can significantly raise the cost for an attacker attempting to guess the six-digit code. Long-term remediation requires refactoring the authentication logic to ensure that all session states and tokens are strictly scoped to their originating tenant context. The application must validate that any request involving client data originates from a valid, authenticated session within the correct tenant boundary, thereby eliminating the possibility of cross-tenant state manipulation. Until patches are available, administrators should monitor for unusual patterns in booking requests and consider disabling online PIN-based authentication if possible, opting instead for more secure multi-factor authentication methods or email-based one-time passwords that do not rely on low-entropy numeric codes susceptible to brute force.