Brute Force Vulnerability in OpenReception's Appointment Booking Software

CVE-2026-65825

What is CVE-2026-65825?

OpenReception's appointment booking software has a vulnerability that allows attackers to brute-force a returning client's six-digit booking PIN. This flaw exists in versions 2.1.0 and prior, where a successful guess provides access to the client's booking access token, enabling them to manipulate the client's appointment tunnel. The vulnerability is particularly concerning as it allows cross-tenant access, meaning an attacker can leverage the state of one tenant to bypass authentication protections in another tenant's environment. This potentially exposes sensitive end-to-end encrypted appointment data. Currently, there are no publicly available fixes for this issue.

References