CVE-2026-48084 open-reception CVE debrief

Who should care

Administrators and users of OpenReception's appointment booking software, especially those with accounts using common base patterns or weak passphrases, should be aware of this vulnerability. Security teams should prioritize patching to version 1.0.2 or applying compensating controls.

Technical summary

CVE-2026-48084 affects OpenReception's appointment booking software versions prior to 1.0.2. The vulnerability allows unlimited failed passphrase login attempts due to a lack of throttling. This is an oversight, as the throttle infrastructure exists and is used for the WebAuthn challenge endpoint. An attacker can exploit this using common base patterns or leaked passwords, making accounts reachable in days on a single CPU or hours on a small GPU farm. The issue is patched in version 1.0.2.

Defensive priority

CVE-2026-48084 is rated HIGH with a CVSS score of 7.4. OpenReception's appointment booking software has a vulnerability in versions prior to 1.0.2, allowing unlimited failed passphrase login attempts. This could lead to credential stuffing and dictionary attacks. Immediate patching to version 1.0.2 or applying compensating controls like IP blocking or rate limiting on login attempts is advised.

Recommended defensive actions

• Patch to version 1.0.2 or later
• Implement rate limiting or IP blocking on login attempts
• Monitor for suspicious login activity
• Enforce strong passphrase policies
• Consider WebAuthn for enhanced security

Evidence notes

The CVE-2026-48084 details indicate that OpenReception's appointment booking software has a vulnerability. Versions prior to 1.0.2 do not throttle failed passphrase login attempts, allowing an attacker to submit unlimited wrong passphrase guesses. The software's backend implements a per-account throttle on the WebAuthn challenge endpoint but not on the passphrase branch in `/api/auth/login`. Version 1.0.2 patches this issue. Evidence is based on CVE and NVD records.

Official resources