Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-65825— OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

Quick assessment

Affected
open-reception appointment-booking-software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenReception 的预约预订软件提供了一个端到端加密的预约预订平台。在 2.1.0 及更早版本中，攻击者可在目标租户内对回头客户的六位预订 PIN 码进行在线暴力破解。一旦成功猜中该 PIN 码，即可获取该客户的预订访问令牌，从而进入其预约隧道（其中包含端到端加密的预约数据），并能够冒充该客户执行操作，例如在隧道中添加或取消预约。该漏洞的绕过机制具有跨租户特性：一个租户拥有的状态数据会移除另一个租户的认证保护。这种跨越租户边界的行为构成了范围变更型攻击向量的基础。截至发布之时，尚无公开可用的补丁。

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-65825

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants
Source: CVE Program / CVE List V5
Vulnerability Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
open-reception appointment-booking-software <= 2.1.0 -

II. Public POCs for CVE-2026-65825

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65825

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-65825 (1)

Same Patch Batch · open-reception · 2026-10-23 · 5 CVEs total

CVE-2026-58202 8.3 HIGH OpenReception: Confirmation-email links built from the request Host enable pending-account
CVE-2026-65824 7.4 HIGH OpenReception: invite confirmation token is replayable within its validity window and re-i
CVE-2026-75524 5.4 MEDIUM OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping ap
CVE-2026-75525 5.3 MEDIUM OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient direct

IV. Related Vulnerabilities

Same product: appointment-booking-software
Same vendor: open-reception
Same weakness: CWE-307

V. Comments for CVE-2026-65825

No comments yet

Leave a comment