CVE-2026-65825: OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running OpenReception version 2.1.0 or earlier are affected. The issue can expose returning clients whose six-digit booking PINs can be targeted in a victim tenant.
What does an attacker need to exploit the bypass?
The attacker needs network access to the booking service and a target client's booking identifier/PIN challenge in the victim tenant. No privileges or user interaction are required, but exploitation has high attack complexity because it relies on cross-tenant throttle state for the same identifier.
What can an attacker do after successfully guessing a PIN?
A successful guess returns the client's booking access token. The attacker can access that client's appointment tunnel and act as the client, including adding or cancelling appointments; the tunnel contains the client's end-to-end-encrypted appointment data.
Is a patch available?
No publicly available patches existed at the time of publication. The provided information does not identify an available fixed version or a documented workaround.