PT-2026-68735

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.4 Description The PIN-type challenge throttle uses emailHash as the sole key within a central challenge throttle table shared across all tenants. This shared architecture allows an attacker who knows a...

CVE-2026-48071: Improper Restriction of Excessive Authentication Attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...