External risk intelligence

OpenReception Appointment Booking E2E Encryption Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-48088

The vulnerability exists in a public-facing API endpoint designed to facilitate appointment booking. As a web-based booking platform, the API is intended to be reachable from the internet by patients to register and book appointments, placing this service directly on the network edge by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in OpenReception's appointment booking software could allow unauthenticated attackers to intercept sensitive patient appointment data. The issue stems from an improperly secured API endpoint that stores encryption keys, undermining the platform's end-to-end encryption claims and potentially exposing confidential information.

Attackers can add themselves to receive encrypted data.
Compromises patient data privacy and trust.
Confirm if this booking system is in use.

Attack Path

How an attacker could exploit the issue

An attacker can target the appointment booking software through a public API endpoint, potentially without needing any prior authentication or a valid user session. By sending specially crafted requests to an unauthenticated API route, an attacker can inject their own encryption keys into the system. These injected keys are then used to encrypt sensitive appointment data, allowing the attacker to intercept and decrypt future patient information, thus compromising the platform's end-to-end encryption claim.

Unauthenticated network access to the API.
Storing attacker-controlled public keys via a specific API route.
Intercepting encrypted patient appointment data.

Live Threat

Current exploitation, exposure, and threat context

The appointment booking platform's end-to-end encryption is compromised, allowing unauthenticated attackers to register as encryption recipients for any tenant's patient appointments. This breaks the platform's security claims, potentially exposing sensitive patient data during the appointment booking process. The vulnerability can also be exploited to inject malformed data, disrupting legitimate booking flows.

Patient appointment data could be exposed.
Attackers can register as encryption recipients.
Booking flows may be disrupted.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of an appointment booking platform's public API, application owners and platform teams are likely responsible for managing this software. The immediate priority is to identify all instances of the affected booking software, confirm its exposure and criticality, and then engage the appropriate owner to plan remediation.

Own the issue.
Verify network exposure and criticality.
Coordinate vendor remediation and plan.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenReception appointment booking software?

OpenReception is a platform designed for scheduling patient appointments. Its core feature is end-to-end encryption, which is meant to ensure that even administrators cannot access sensitive appointment details. It relies on a specialized cryptographic setup where the system stores public keys to encrypt data for authorized recipients, such as medical staff, before it is shared or stored.

How does CVE-2026-48088 undermine encryption?

This vulnerability, classified as CWE-862 (Missing Authorization), allows an unauthorized person to add their own public key to the system. Because the software fails to verify who is submitting the key, an attacker can register as a recipient for any appointment. When new appointments are created, the system uses the attacker's key to encrypt the data, effectively granting the attacker a copy of the sensitive information.

Do I need to be authenticated to trigger this bug?

No. The software's API endpoint is designed to accept requests without any login, session, or registration cookie. While the system attempts to log unauthorized attempts, an attacker can bypass this security check by omitting the email field in the request. This trick causes the application to incorrectly treat the malicious request as a legitimate registration, silencing the warning and allowing the attacker to inject their key undetected.

Is my system at risk according to Halo Surface Signal?

Yes, if your deployment is accessible from the internet. Halo Surface Signal identifies this service as having a 'Very likely' risk profile because the affected API endpoint is purposefully designed to be reachable by patients over the public network. Since the software is meant to sit at the network edge to facilitate booking, it is inherently exposed to any remote user who knows how to reach that specific API path.

When should I take action to secure this software?

You should prioritize this immediately by identifying every instance of OpenReception running in your environment. Since this flaw allows unauthorized parties to intercept private data by poisoning the appointment key directory, standard access controls may not protect you. Confirm your current version and coordinate with your technical team to apply the vendor's provided updates, which are necessary to enforce proper authentication and input validation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.