OpenReception appointment-booking-software up to 1.0.5 Bootstrap Challenge bootstrap-challenge tunnelId/clientPublicKey/emailHash allocation of resources

Summaryinfo

A vulnerability classified as critical has been found in OpenReception appointment-booking-software up to 1.0.5. The impacted element is an unknown function of the file /api/tenants/{id}/appointments/bootstrap-challenge of the component Bootstrap Challenge. This manipulation of the argument tunnelId/clientPublicKey/emailHash causes allocation of resources. This vulnerability appears as CVE-2026-48082. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability has been found in OpenReception appointment-booking-software up to 1.0.5 and classified as critical. Affected by this vulnerability is some unknown processing of the file /api/tenants/{id}/appointments/bootstrap-challenge of the component Bootstrap Challenge. The manipulation of the argument tunnelId/clientPublicKey/emailHash with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect integrity, and availability. The summary by CVE is:

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/api/tenants/{id}/appointments/bootstrap-challenge` issues a SHA-256 proof-of-work with `difficulty=4` hex zeros, equivalent to 16 bits of work. Modern hardware solves this in under 200 milliseconds, providing essentially no friction against automated abuse of the patient booking flow. Proof-of-work is used in the booking flow as a rate-limiter for unauthenticated clients establishing tunnels and submitting appointments. At 16 bits of difficulty, the construct is decorative rather than effective. An attacker can solve PoW challenges as fast as the server can issue them, defeating the rate-limiting purpose. The handler also calls `challengeThrottleService.checkThrottle(binding, "passkey")`, but the binding includes attacker-controlled values (`tunnelId`, `clientPublicKey`, and optional `emailHash`). For each fresh attempt, the attacker can supply new values, producing a new throttle key and bypassing the per-binding accumulation. Practical abuse friction is therefore the PoW difficulty itself, not a stable per-IP or per-email server-side throttle. Version 1.0.6 fixes the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-48082 since 05/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.0.6 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Appointment Software

Vendor

• OpenReception

Name

• appointment-booking-software

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion