CVE-2026-48084

Received Received - Intake

Brute Force Login in OpenReception Appointment Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48084

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability is in OpenReception's appointment booking software versions before 1.0.2. It allows attackers to repeatedly guess user passphrases without rate limiting, enabling credential stuffing and dictionary attacks. The system has a throttle mechanism for WebAuthn logins but fails to apply it to passphrase logins, leaving this path unprotected.

Detection Guidance

Check if your OpenReception software version is prior to 1.0.2. Monitor login attempts for failed passphrase submissions against known email addresses. Look for sustained high rates of login attempts (around 10 per second) without HTTP 429 responses. Verify if the passphrase login endpoint `/api/auth/login` lacks throttling while WebAuthn challenges enforce rate limits.

Impact Analysis

Attackers could gain unauthorized access to user accounts by guessing weak passphrases. Accounts using common patterns or leaked passwords are particularly vulnerable. The attack can be automated and scaled, potentially compromising sensitive appointment data or allowing impersonation.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Upgrade to OpenReception version 1.0.2 or later to patch the missing throttling mechanism. Implement additional rate limiting at the network or application level for the passphrase login endpoint. Enforce stronger passphrase policies beyond the current minimum 12-character requirement to reduce susceptibility to dictionary attacks.

Hi! I’m here to help you understand CVE-2026-48084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70