CVE-2026-65825 Details

A vulnerability in OpenReception's appointment booking software in versions through 2.1.0 allows for the online brute-forcing of a returning client's six-digit booking PIN within the victim tenant. Exploiting this vulnerability retrieves the client's booking access token, which provides access to their appointment tunnel containing end-to-end encrypted appointment data. Additionally, it allows actions such as adding or cancelling appointments. The vulnerability crosses tenant boundaries, as state owned by one tenant can remove authentication protections in another, leading to unauthorized access.

The recommended fix is to synchronize the throttle mechanism across tenants, ensuring that one tenant cannot interfere with another's throttle state. This can be achieved by making the throttle key consistent for both reading and writing operations, or by removing the tenant filter on reads to maintain uniform throttling. Additionally, the rate limiter's client IP should not be derived from an unvalidated 'x-forwarded-for' header, but rather from a trusted source. Consider increasing the complexity of the booking PIN or implementing a second authentication factor for returning clients.