CVE-2026-48088 — OpenReception's appointment booking software provides an end-to-end encrypted appointment…¶

Key facts

CVE-2026-48088 is a Critical (9.4) vulnerability: OpenReception's appointment booking software provides an end-to-end encrypted appointment…. This entry ships a detection-only PoC and a Docker test lab.


CVE	CVE-2026-48088
Severity	Critical (9.4)
Detection / prevention	—
PoC	poc.py
Source	2026/CVE-2026-48088/

Details¶

English | 한국어

Description¶

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/{tenantId}/staff/{staffId}/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without authentication. The handler logs an "Unauthorized crypto key storage attempt" warning when neither a session nor a registration cookie is present, then proceeds to insert the row regardless. The platform's E2E claim that "even administrators cannot view sensitive information" is broken: any unauthenticated network attacker can register themselves as an additional encryption recipient for any tenant's future patient appointments. A second variant of the bug suppresses the unauthorized-warning log entry. The Zod schema makes the email field optional. When the request body omits email and the request carries no registration cookie, the comparison registrationEmail === email becomes undefined === undefined, which evaluates to true. The handler treats the request as a legitimate registration flow, skips the warning entirely, and stores the row. Successful storage is still recorded as an [info] log line, but the security-relevant warning that operators are most likely to monitor or alert on is gone. The staff_crypto table has no unique constraint on user_id, so an arbitrary number of attacker rows can coexist for the same staff identifier and all return as is_active=true. The supplied staffId does not need to match any existing user or pending invite. Schema validation on passkeyId, publicKey, and privateKeyShare is also weak: the literal string <placeholder-base64> was accepted, indicating no length, format, or cryptographic-validity check beyond field presence. This weakness is independent of the auth bypass but compounds it: a poisoned directory can also be filled with malformed entries that break legitimate booking flows. The injected key is consumed by the public booking flow. After completing the unauthenticated bootstrap-challenge and bootstrap-verify ceremony as a "patient", the resulting bookingAccessToken is accepted by GET /api/tenants/{id}/appointments/staff-public-keys, which returns the attacker-controlled keys alongside any legitimate ones. A new appointment encrypts its tunnel key with ML-KEM to all listed recipients, so the attacker becomes a co-recipient of the encryption and can decapsulate the tunnel key with the matching secret. From there, all appointment payloads for that booking are decryptable. Version 1.0.4 patches the issue.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-48088
CVSS Score	9.4

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-48088/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-48088

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/open-reception/appointment-booking-software/commit/78dfd9317a0be0897e6e4d73afe670c07a75460f
https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-pch3-hcmf-cjw4

Generated by PoC Generator on 2026-08-08T11:52:12.320710376

Frequently asked questions¶

What is CVE-2026-48088?¶

CVE-2026-48088 is a Critical (9.4) vulnerability: OpenReception's appointment booking software provides an end-to-end encrypted appointment…. This entry ships a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-48088?¶

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2026-48088?¶

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.