Incorrect authorization in OpenReception lets attackers add staff keys
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
OpenReception appointment booking software up to and including 2.1.0 has an incorrect authorization flaw (CWE-863) in its staff-crypto recipient directory. An unauthenticated remote attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's directory. Booking clients then encrypt the tunnel key of each later appointment in that tenant to that key, so the attacker, who holds the matching secret key, receives that key material.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writable, so that even administrators and the operator cannot read patient data. This endpoint breaks that guarantee for an unauthenticated remote actor: it allows writing an arbitrary encryption recipient into the recipient directory of any tenant. The injected key receives the tunnel key of every appointment booked afterward in that tenant, because booking clients encrypt to all active staff keys. The attacker holds the corresponding secret key and is a persistent, unauthorized recipient of that key material. At time of publication, there are no publicly available patches.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-reception | appointment-booking-software | up to 2.1.0 | — | No fix listed | CNA |
- appointment-booking-software Vendoropen-reception Affected up to 2.1.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for OpenReception appointment booking software.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-23 Threatist record created from CVE-2026-75525
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: LOW → MEDIUM
References
More open-reception vulnerabilities
- TI-2026-35529 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory CVSS 3.1CRITICAL 9.4
- TI-2026-35528 OpenReception: WebAuthn passkey injection allows account takeover CVSS 3.1CRITICAL 9.8
- TI-2026-35526 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap CVSS 3.1CRITICAL 9.8
- TI-2026-35527 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN CVSS 3.1CRITICAL 9.9
- TI-2026-79990 Host header poisoning in OpenReception enables account takeover CVSS 3.1HIGH 8.3
- TI-2026-35522 OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer CVSS 3.1HIGH 8.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences