CVE-2026-48082

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48082", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:40:45.831Z", "datePublished": "2026-08-06T21:14:16.625Z", "dateUpdated": "2026-08-07T17:08:58.392Z"}, "containers": {"cna": {"title": "OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g"}, {"name": "https://github.com/open-reception/appointment-booking-software/commit/e9c96c049ebf558df7a9e4c5c93f6fe2b092c8c6", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-reception/appointment-booking-software/commit/e9c96c049ebf558df7a9e4c5c93f6fe2b092c8c6"}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"version": "< 1.0.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:14:16.625Z"}, "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/api/tenants/{id}/appointments/bootstrap-challenge` issues a SHA-256 proof-of-work with `difficulty=4` hex zeros, equivalent to 16 bits of work. Modern hardware solves this in under 200 milliseconds, providing essentially no friction against automated abuse of the patient booking flow. Proof-of-work is used in the booking flow as a rate-limiter for unauthenticated clients establishing tunnels and submitting appointments. At 16 bits of difficulty, the construct is decorative rather than effective. An attacker can solve PoW challenges as fast as the server can issue them, defeating the rate-limiting purpose. The handler also calls `challengeThrottleService.checkThrottle(binding, \"passkey\")`, but the binding includes attacker-controlled values (`tunnelId`, `clientPublicKey`, and optional `emailHash`). For each fresh attempt, the attacker can supply new values, producing a new throttle key and bypassing the per-binding accumulation. Practical abuse friction is therefore the PoW difficulty itself, not a stable per-IP or per-email server-side throttle. Version 1.0.6 fixes the issue."}], "source": {"advisory": "GHSA-hm9g-mh7x-657g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:58:35.100533Z", "id": "CVE-2026-48082", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:08:58.392Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48082", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T14:58:35.100533Z"}}}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:58:48.681Z"}}], "cna": {"title": "OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification", "source": {"advisory": "GHSA-hm9g-mh7x-657g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"status": "affected", "version": "< 1.0.6"}]}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g", "name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-reception/appointment-booking-software/commit/e9c96c049ebf558df7a9e4c5c93f6fe2b092c8c6", "name": "https://github.com/open-reception/appointment-booking-software/commit/e9c96c049ebf558df7a9e4c5c93f6fe2b092c8c6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/api/tenants/{id}/appointments/bootstrap-challenge` issues a SHA-256 proof-of-work with `difficulty=4` hex zeros, equivalent to 16 bits of work. Modern hardware solves this in under 200 milliseconds, providing essentially no friction against automated abuse of the patient booking flow. Proof-of-work is used in the booking flow as a rate-limiter for unauthenticated clients establishing tunnels and submitting appointments. At 16 bits of difficulty, the construct is decorative rather than effective. An attacker can solve PoW challenges as fast as the server can issue them, defeating the rate-limiting purpose. The handler also calls `challengeThrottleService.checkThrottle(binding, \"passkey\")`, but the binding includes attacker-controlled values (`tunnelId`, `clientPublicKey`, and optional `emailHash`). For each fresh attempt, the attacker can supply new values, producing a new throttle key and bypassing the per-binding accumulation. Practical abuse friction is therefore the PoW difficulty itself, not a stable per-IP or per-email server-side throttle. Version 1.0.6 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:14:16.625Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48082", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:08:58.392Z", "dateReserved": "2026-05-20T18:40:45.831Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T21:14:16.625Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "appointment-booking-software", "vendor": "open-reception", "versions": [{"status": "affected", "version": "< 1.0.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/api/tenants/{id}/appointments/bootstrap-challenge` issues a SHA-256 proof-of-work with `difficulty=4` hex zeros, equivalent to 16 bits of work. Modern hardware solves this in under 200 milliseconds, providing essentially no friction against automated abuse of the patient booking flow. Proof-of-work is used in the booking flow as a rate-limiter for unauthenticated clients establishing tunnels and submitting appointments. At 16 bits of difficulty, the construct is decorative rather than effective. An attacker can solve PoW challenges as fast as the server can issue them, defeating the rate-limiting purpose. The handler also calls `challengeThrottleService.checkThrottle(binding, \"passkey\")`, but the binding includes attacker-controlled values (`tunnelId`, `clientPublicKey`, and optional `emailHash`). For each fresh attempt, the attacker can supply new values, producing a new throttle key and bypassing the per-binding accumulation. Practical abuse friction is therefore the PoW difficulty itself, not a stable per-IP or per-email server-side throttle. Version 1.0.6 fixes the issue."}, {"lang": "es", "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Antes de la versi\u00f3n 1.0.6, el endpoint de desaf\u00edo de arranque en \u201c/api/tenants/{id}/appointments/bootstrap-challenge\u201d emite una prueba de trabajo SHA-256 con \u201cdifficulty=4\u201d ceros hexadecimales, equivalente a 16 bits de trabajo. El hardware moderno resuelve esto en menos de 200 milisegundos, proporcionando esencialmente ninguna fricci\u00f3n contra el abuso automatizado del flujo de reserva de pacientes. La prueba de trabajo se utiliza en el flujo de reserva como un limitador de velocidad para clientes no autenticados que establecen t\u00faneles y env\u00edan citas. Con 16 bits de dificultad, la construcci\u00f3n es decorativa en lugar de efectiva. Un atacante puede resolver desaf\u00edos de PoW tan r\u00e1pido como el servidor puede emitirlos, frustrando el prop\u00f3sito de limitaci\u00f3n de velocidad. El gestor tambi\u00e9n llama a \u201cchallengeThrottleService.checkThrottle(binding, \u201cpasskey\u201d)\u201d, pero el binding incluye valores controlados por el atacante (\u201ctunnelId\u201d, \u201cclientPublicKey\u201d, y \u201cemailHash\u201d opcional). Para cada nuevo intento, el atacante puede proporcionar nuevos valores, produciendo una nueva clave de limitaci\u00f3n y eludiendo la acumulaci\u00f3n por binding. La fricci\u00f3n pr\u00e1ctica contra el abuso es, por lo tanto, la dificultad de la PoW en s\u00ed misma, no una limitaci\u00f3n estable por IP o por correo electr\u00f3nico del lado del servidor. La versi\u00f3n 1.0.6 corrige el problema."}], "id": "CVE-2026-48082", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48082", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T14:58:35.100533Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:10.997", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/commit/e9c96c049ebf558df7a9e4c5c93f6fe2b092c8c6"}, {"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hm9g-mh7x-657g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "appointment-booking-software", "source": "cna", "vendor": "open-reception"}, "product": "appointment-booking-software", "vendor": "open-reception"}], "created": "2026-08-07T00:30:06.734904+00:00", "updated": "2026-08-07T09:58:55.158108+00:00", "vendors": ["open-reception", "open-reception$PRODUCT$appointment-booking-software"]}