Arbitrary Key Injection Vulnerability in OpenReception's Appointment Booking Software

CVE-2026-75525

What is CVE-2026-75525?

An unauthenticated attacker can exploit a vulnerability in OpenReception's appointment booking software to inject an arbitrary ML-KEM-768 public key into the staff-crypto recipient directory. This allows the attacker to receive encryption keys for all subsequent appointments, compromising sensitive patient data that is supposed to remain secure through end-to-end encryption. The software's design prevents administrators and operators from accessing patient data, but this vulnerability circumvents those protections, making unauthorized access to encrypted appointment details possible.

References