Vulnerability feed

Executive summary

An unauthenticated remote attacker can insert an encryption key of their own choosing into the staff key directory of OpenReception's appointment booking software, so future appointments in the affected tenant get encrypted to that key as well. The advisory rates this Moderate with a CVSS 3.1 score of 5.3 and says the flaw affects versions up to and including 2.1.0. The advisory states that no patched version is available, and it does not state a workaround.

Technical summary

The flaw is an incorrect authorization issue (CWE-863) in the POST /api/tenants/{id}/staff/{staffId}/crypto handler, which accepts a registration write when the webauthn-registration-email cookie matches the request-body email. The cookie can be obtained without authentication by calling POST /api/auth/challenge with any email, including one that does not exist. The write is not bound to the target staff member's stored email, the tenant membership, or a signed registration session. The advisory lists affected versions as <= 2.1.0 and patched versions as None. It states that the attacker cannot retrieve ciphertext on its own because retrieval requires a valid staff session, and that the issue can be exploited only for users without an active key. No workaround is stated, and no specific detection guidance is stated. The advisory recommends requiring the signed registration-bootstrap session and binding the write to the target staff email and tenant.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/open-reception/appointment-b…/GHSA-qc72-9fg9-h66h

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affects

open-receptionopen-reception appointment-booking-softwareopen-reception OpenReception

Executive summary

The advisory describes a fix in OpenReception's appointment booking software, which provides an end-to-end encrypted appointment booking platform. It shows a code change that adds row locking and transactions to prevent double-booking of agents when appointments are created at the same time, but it does not state a severity rating or a CVE-specific impact in the text provided.

Technical summary

The advisory is a copied code diff from a commit in the appointment service, not a formal vulnerability description. The change moves the agent availability check into a database transaction and adds a SELECT ... FOR UPDATE lock on the agent row, which the code comment says is meant to avoid race conditions between concurrent appointment creations. Attack vector, preconditions, CVSS score, affected versions, fixed versions, workarounds, and exploitation status are not stated in the advisory. Vulnerability class is implied to be a race condition (likely double-booking), but the advisory does not name it explicitly.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/open-reception/appointment-b…897dc1f494ace2f0e452

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affects

open-receptionopen-reception appointment-booking-software

Executive summary

A flaw in OpenReception's appointment booking software lets one tenant disable the PIN brute-force protection that applies to a returning client in another tenant, so a six-digit booking PIN could be guessed online. The advisory rates it High with a CVSS score of 7.5 and states that no patched version is available (patched versions: None). The advisory does not state a vendor-recommended fix beyond the changes the researcher suggests.

Technical summary

This is an improper restriction of excessive authentication attempts (CWE-307) caused by inconsistent tenant scoping in the challenge_throttle table. The throttle row is keyed on the tenant-independent emailHash, but reads filter by tenant_id while writes never update it, so the first tenant to record a failure owns the row and other tenants see no throttle. Exploitation is over the network with no privileges or user interaction, but requires two tenants on one instance and knowledge of the victim's email. The advisory lists affected versions as <= 2.1.0 and patched versions as None. It states no workaround from the vendor, though the researcher recommends a consistent throttle key, not trusting x-forwarded-for for rate limiting, and raising PIN entropy. The advisory does not state whether the flaw has been exploited in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/open-reception/appointment-b…/GHSA-v4q4-xmqf-gmq8

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Affects

open-receptionopen-reception appointment-booking-softwareopen-reception OpenReception

Executive summary

The advisory describes a fix in the OpenReception appointment booking software, where an invitation token could be reused to sign up again. The advisory shows a code change that stops used invitations from being accepted and marks invites as used sooner, and it does not give a severity rating. The advisory does not state any vendor recommendation beyond the code change.

Technical summary

The flaw appears to be reuse of an invitation token in the user registration flow in src/lib/server/services/user-service.ts. The patch adds a check that the invite has not been used before accepting it, and moves the call that marks the invite as used so it runs regardless of the user confirmation state. The advisory does not state the vulnerability class, CVE-specific impact, attack preconditions, affected versions, fixed versions, workarounds, CVSS score, or detection guidance. The advisory does not state whether the issue has been exploited in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/open-reception/appointment-b…c0a6deb9267bfec03622

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affects

open-receptionopen-reception appointment-booking-softwareopen-reception OpenReception

Executive summary

The advisory covers OpenReception, an end-to-end encrypted appointment booking platform. The text provided is a GitHub release page for v2.0.0 that mentions a fix for a security advisory (GHSA-w5g9-g2p4-2g4m) but does not describe the flaw's impact or severity. The advisory does not state how serious the issue is, and it does not say whether it is being exploited.

Technical summary

The release notes say the fix for GHSA-w5g9-g2p4-2g4m, reported by Volcore, is included in v2.0.0, but they do not name the vulnerability class, attack vector, or preconditions. The release also makes a breaking change by requiring a new MANAGEMENT_DOMAIN environment variable, which the notes say ensures security for system administration. Affected versions are not stated in the text, though the release is compared against v1.1.1 in the changelog. No CVSS score, workaround, or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/open-reception/appointment-b…/releases/tag/v2.0.0

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Affects

open-receptionopen-reception appointment-booking-softwareopen-reception OpenReception