{"id":"CVE-2026-65825","aliases":[],"cve":{"records":[{"id":"CVE-2026-65825","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-22T23:16:47.752Z","published":"2026-10-23T20:29:17.174Z","modified":"2026-10-26T17:45:38.981Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T20:29:17.174Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T17:45:38.981Z"}],"references":[{"url":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v4q4-xmqf-gmq8","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-307","description":"CWE-307: Improper Restriction of Excessive Authentication Attempts","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T15:39:10.074928Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or cancelling appointments in the tunnel. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. This crossing of the tenant boundary is the basis for the scope-changed vector. At time of publication, there are no publicly available patches.","score":7.5,"severity":"high","published":"2026-10-23T20:29:17.174Z","modified":"2026-10-26T17:45:38.981Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"open-reception","name":"appointment-booking-software","platforms":[],"versions":[{"version":"<= 2.1.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-65825"}],"remediation":[],"references":["https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v4q4-xmqf-gmq8"],"sources":[{"name":"CVE","id":"CVE-2026-65825","modified":"2026-10-26T17:45:38.981Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-65825"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T14:42:27.018Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"OpenReception's appointment booking software, versions 2.1.0 and prior, has a weakness where one tenant's throttle row can disable the PIN brute-force throttle for the same identifier in other tenants, potentially allowing access to a client's appointment data. The weakness is due to improper restriction of excessive authentication attempts. No patches are publicly available.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:24:33.153Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-65825"}]}}