CVE-2026-48087 open-reception CVE debrief

Who should care

OpenReception users, administrators, and maintainers should be aware of this critical vulnerability and take immediate action to apply the patch and assess their exposure surfaces. The vulnerability can lead to account takeover if not addressed promptly. It is essential to review and apply the patch from version 1.0.2, assess the exposure surfaces of user IDs on the platform, and implement additional monitoring and logging to detect potential attacks.

Technical summary

The registration handler at `POST /api/auth/register/{userId}` in OpenReception's appointment booking software validates the relationship between the WebAuthn challenge and the registration cookie's email but never validates that the `userId` in the URL belongs to that email. This allows an unauthenticated attacker to potentially take over a victim's account by submitting a registration response with their own authenticator against the victim's URL. The vulnerability has a CVSS score of 9.8 and is considered critical.

Defensive priority

OpenReception's appointment booking software has a critical vulnerability. Immediate attention is required to prevent potential account takeovers.

Recommended defensive actions

• Review and apply the patch from version 1.0.2
• Assess the exposure surfaces of user IDs on the platform
• Verify that user IDs are not leaked through unauthenticated routes or administrative views
• Implement additional monitoring and logging to detect potential attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that OpenReception's appointment booking software has a vulnerability in its registration handler. An unauthenticated attacker can request a challenge for their own email, generate a registration response with their own authenticator, and submit it against any victim user's URL, potentially leading to account takeover.

Official resources