OpenReception appointment booking software encrypts all booking data, but in versions 2.1.0 and earlier a six‑digit PIN can be brute‑forced against the booking API. A successful guess returns a booking access token that grants complete access to the client’s encrypted appointment tunnel. The victim can view, modify, or delete appointments. Based on the description, it is inferred that the attacker can impersonate clients and manipulate the appointment data. The flaw is further amplified by a tenant boundary issue: brute‑forcing a PIN in one tenant inadvertently removes the PIN‑brute‑force throttle for the same physical identifier in another tenant, allowing an attacker to target a second tenant without needing to brute‑force that tenant’s PIN. This cross‑tenant state leakage expands the scope of the attack and turns a single‑tenant credential guess into an application‑wide privilege escalation. The weakness is a classic authentication bypass (CWE‑307).

The software publisher, OpenReception, offers the open‑source appointment‑booking platform. The vulnerability affects all releases 2.1.0 and older. No official patch is published at the time of the advisory. Users running those versions are exposed.

The CVSS score of 7.5 indicates a high‑severity vulnerability. There is no EPSS data, but the flaw relies on an online brute‑force attempt that can be performed from any network connection. The likely attack vector is an online brute‑force of the booking PIN from any network connection. Since the attack crosses tenant boundaries, a single compromised tenant can compromise all others, as inferred from the description. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported, but the lack of a protective throttle in other tenants makes it straightforward to maintain persistence. Administrators should treat this as a high‑risk issue until a patch is released.