Open-Reception Appointment Booking Software up to 1.0.1 Passphrase Login /api/auth/login excessive authentication

Summaryinfo

A vulnerability classified as problematic was found in Open-Reception Appointment Booking Software up to 1.0.1. This affects an unknown function of the file /api/auth/login of the component Passphrase Login. Such manipulation leads to excessive authentication. This vulnerability is traded as CVE-2026-48084. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Open-Reception Appointment Booking Software up to 1.0.1 and classified as problematic. Affected by this issue is an unknown function of the file /api/auth/login of the component Passphrase Login. The manipulation with an unknown input leads to a excessive authentication vulnerability. Using CWE to declare the problem leads to CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. Impacted is confidentiality. CVE summarizes:

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-48084 since 05/20/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

Upgrading to version 1.0.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Appointment Software

Vendor

• Open-Reception

Name

• Appointment Booking Software

Version

• 1.0.0
• 1.0.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion