CVE-2026-48082

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.6

Description The bootstrap challenge endpoint /api/tenants/{id}/appointments/bootstrap-challenge implements a SHA-256 proof-of-work (PoW) mechanism intended to rate-limit unauthenticated clients. However, the difficulty=4 setting (16 bits of work) is too low, allowing modern hardware to solve challenges in under 200 milliseconds and enabling automated abuse of the booking flow. Additionally, the challengeThrottleService.checkThrottle(binding, "passkey") function relies on a binding containing attacker-controlled variables such as tunnelId, clientPublicKey, and emailHash. By providing new values for these variables in each attempt, an attacker can generate new throttle keys and bypass server-side rate limiting.

Recommendations Update to version 1.0.6.