Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75525— OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant

Quick assessment

Affected
open-reception appointment-booking-software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenReception 的预约预订软件提供了一个端到端加密的预约预订平台。在 2.1.0 及更早版本中，未认证的攻击者可以在任何租户的“员工加密接收者目录”中，将任意 ML-KEM-768 公钥存储在任何现有用户的身份下。该产品的设计保证预约数据对员工进行端到端加密，且员工接收者目录不可由攻击者写入，因此即使是管理员和系统运营者也无法读取患者数据。然而，该端点破坏了这一安全保证：它允许未认证的远程攻击者在任意租户的接收者目录中写入任意的加密接收者。被注入的公钥将接收此后该租户内所有预约的隧道密钥，因为预订客户端

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75525

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
Source: CVE Program / CVE List V5
Vulnerability Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writable, so that even administrators and the operator cannot read patient data. This endpoint breaks that guarantee for an unauthenticated remote actor: it allows writing an arbitrary encryption recipient into the recipient directory of any tenant. The injected key receives the tunnel key of every appointment booked afterward in that tenant, because booking clients encrypt to all active staff keys. The attacker holds the corresponding secret key and is a persistent, unauthorized recipient of that key material. At time of publication, there are no publicly available patches.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
open-reception appointment-booking-software <= 2.1.0 -

II. Public POCs for CVE-2026-75525

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75525

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75525 (1)

Same Patch Batch · open-reception · 2026-10-23 · 5 CVEs total

CVE-2026-58202 8.3 HIGH OpenReception: Confirmation-email links built from the request Host enable pending-account
CVE-2026-65825 7.5 HIGH OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the sam
CVE-2026-65824 7.4 HIGH OpenReception: invite confirmation token is replayable within its validity window and re-i
CVE-2026-75524 5.4 MEDIUM OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping ap

IV. Related Vulnerabilities

Same product: appointment-booking-software
Same vendor: open-reception
Same weakness: CWE-863

V. Comments for CVE-2026-75525

No comments yet

Leave a comment