---
id: CVE-2026-48084
title: >-
  OpenReception's appointment booking software provides an end-to-end encrypted
  appointment booking platform
summary: >-
  OpenReception's appointment booking software provides an end-to-end encrypted
  appointment booking platform. Versions prior to 1.0.2 don't throttle failed
  passphrase login attempts. An attacker can submit unlimited wrong passphrase
  guesse…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-307
published: '2026-08-06'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48084'
references:
  - url: >-
      https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00388
epssPercentile: 0.30028
ingestedAt: '2026-09-08T21:11:12.270Z'
---

## Overview

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.