CVE-2026-48071: Improper Restriction of Excessive Authentication Attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

PT-2026-68740

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5 Description The unauthenticated '/api/tenants/id/schedule' endpoint returns all non-archived channels for a tenant, ignoring the isPublic flag. This allows the disclosure of private channels intended to be...