# CVE-2026-48076: OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

> Attackers can book appointments on private channels by bypassing authorization checks in the new-client flow, requiring out-of-band channel ID discovery.

- **Severity:** Medium 6.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 6 Aug 2026
- **Updated:** 7 Aug 2026
- **Also known as:** GHSA-3658-3j75-p5j3

## What is CVE-2026-48076?

CVE-2026-48076 is a medium-severity missing authorization vulnerability in open-reception appointment-booking-software, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available.

Weakness: CWE-863 (Incorrect Authorization)

## Which versions are affected by CVE-2026-48076?


## How do I fix CVE-2026-48076?

No fix has been published for CVE-2026-48076 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-48076 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48076 exists.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-48076 and fix it if it is affected.

What it is: CVE-2026-48076 is a medium-severity missing authorization vulnerability in open-reception appointment-booking-software, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48076 exists.

Affected product: open-reception appointment-booking-software. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-48076/ (Markdown: https://insights.sbomify.com/CVE-2026-48076/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-48076
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48076
- OSV: https://osv.dev/vulnerability/CVE-2026-48076

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-48076/
Summaries are generated and may contain mistakes; the official description above is the record.