CVE-2026-48071

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.4

Description The PIN-type challenge throttle uses emailHash as the sole key within a central challenge throttle table shared across all tenants. This shared architecture allows an attacker who knows a patient's email to cause a denial of service for that patient across multiple tenants. By sending failed challenge responses to the /api/tenants/{id}/appointments/verify-challenge endpoint of one tenant, the attacker increments a shared row that is read by the /api/tenants/{id}/appointments/challenge endpoint of other tenants. This results in a lockout that escalates in duration from 60 seconds after 4 failed attempts, up to 60 minutes with repeated failures.

Recommendations Update to version 1.0.4.