CVE-2026-75524
OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.
| CWE | CWE-367 |
| Vendor | open-reception |
| Product | appointment-booking-software |
| Published | Oct 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for open-reception appointment-booking-software
Be the first to know when new medium vulnerabilities affecting open-reception appointment-booking-software are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
open-reception / appointment-booking-software
< 2.2.2
References
github.com: https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j github.com: https://github.com/open-reception/appointment-booking-software/commit/73663288a8d4ad2ad31d897dc1f494ace2f0e452 github.com: https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.2