THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-48088 (CRITICAL 9.4) — OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on

[NVD] CVE-2026-48088 (CRITICAL 9.4) — OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on

mednvdPublished 2026-08-06

CVE-2026-48088 CVSS: 9.4 CRITICAL Published: 2026-08-06T22:17:11.893

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without authentication. The handler l

Indicators of compromise

CVE-2026-48088cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-48088