open-reception appointment-booking-software up to 1.0.3 throttle service emailHash denial of service

Summaryinfo

A vulnerability described as problematic has been identified in open-reception appointment-booking-software up to 1.0.3. This vulnerability affects unknown code of the component throttle service. Executing a manipulation of the argument emailHash can lead to denial of service. This vulnerability appears as CVE-2026-48071. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in open-reception appointment-booking-software up to 1.0.3. It has been declared as problematic. This vulnerability affects an unknown code block of the component throttle service. The manipulation of the argument emailHash with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses `emailHash` as the only key. The throttle rows live in the central `challenge_throttle` table, which is shared across all tenants. Every tenant's `/api/tenants/{id}/appointments/verify-challenge` endpoint increments the same row when a PIN response fails, and every tenant's `/api/tenants/{id}/appointments/challenge` endpoint reads the same row when deciding whether to issue a new challenge. When the same `emailHash` exists in multiple tenants on the same OpenReception instance (the same patient holding tunnels in two different clinics that share the platform), an attacker who knows the patient's email can lock out that patient on tenant B by issuing failed challenge responses against tenant A. The attacker needs no relationship to tenant B; the lockout propagates through the shared throttle row. The lockout escalates with repeated failures. The first lockout triggers at 4 failed attempts and lasts approximately 60 seconds. Subsequent failures escalate the lockout duration to 5 minutes, 30 minutes, and 60 minutes per the throttle service's escalation logic. Repeated bursts produce sustained denial of service against the targeted email. Version 1.0.4 patches the issue.

The advisory is available at github.com. This vulnerability was named CVE-2026-48071 since 05/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 1.0.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Appointment Software

Vendor

• open-reception

Name

• appointment-booking-software

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3

Website

• Product: https://github.com/open-reception/appointment-booking-software/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion