The vulnerability stems from an intentionally low proof‑of‑work difficulty set at four hexadecimal zeros (16 bits) for the bootstrap challenge endpoint. This low difficulty allows an attacker to solve challenges in a few hundred milliseconds, effectively removing the friction meant to throttle unauthenticated users. The PoW function intersects with a binder that includes attacker‑controlled values, so each new request can generate a new throttle key, further neutralizing the intended per‑binding accumulation. The result is a de‑emphasized rate‑limit that permits large‑scale automated booking or tunnel creation without meaningful cost to the client.

OpenReception appointment‑booking software, version prior to 1.0.6. The software delivers a fully encrypted booking experience and relies on the bootstrap challenge for rate limiting. Versions 1.0.6 and later contain a fix that increases the PoW difficulty; older releases remain vulnerable.

The CVSS score of 3.7 indicates moderate severity, reflecting that the main risk is operational abuse rather than critical compromise. Because the PoW challenge solves in milliseconds on modern hardware, an attacker can issue requests virtually as fast as the server can produce them, dramatically thinning out the rate‑limiting effect. The vulnerability is not currently listed in the CISA KEV catalog and no EPSS score is available, suggesting limited evidence of exploitation but the mechanics allow abuse at scale when an organization depends on this endpoint for throttling. The recommended mitigation is to move to the patched version or provide a stronger PoW difficulty to restore client‑side friction.