CVE-2026-48084 open-reception CVE debrief

Who should care

Defenders responsible for OpenReception's appointment booking software should assess exposure and prioritize patching to prevent potential credential stuffing and dictionary attacks. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-48084 is a high-severity vulnerability in OpenReception's appointment booking software that allows for unlimited failed passphrase login attempts, making it susceptible to credential stuffing and dictionary attacks.

• Credential stuffing and dictionary attacks are possible due to lack of throttle on passphrase login attempts
• Accounts using common base patterns or words from a leak corpus are realistically reachable

Technical summary

The vulnerability allows for unlimited failed passphrase login attempts due to an oversight in the implementation of the throttle infrastructure for the passphrase branch. This makes it susceptible to credential stuffing and dictionary attacks. The issue was addressed in version 1.0.2. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts.

Defensive priority

Defenders should prioritize patching to prevent credential stuffing and dictionary attacks.

Recommended defensive actions

• Patch to version 1.0.2 or later
• Implement WebAuthn challenge endpoint throttle
• Monitor for suspicious login attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide details on the vulnerability and its patch. The passphrase branch in `/api/auth/login` was not updated to record failed attempts, leaving a supported high-value login path unprotected. The throttle infrastructure exists and is wired into the same auth backend, working on the WebAuthn path. However, the asymmetry confirms this is an oversight rather than a design choice. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.