CVE-2026-48084
OpenReception doesn't rate limit passphrase login attempts
Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue.
INFO
Published Date :
Aug. 6, 2026, 10:17 p.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-48084
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update software to version 1.0.2.
- Verify failed login attempt throttling.
- Implement stronger passphrase policies.
- Monitor for credential stuffing attacks.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48084.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48084 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48084
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48084 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48084 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: appointment-booking-software de open-reception, Description: El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Las versiones anteriores a la 1.0.2 no limitan los intentos fallidos de inicio de sesión con frase de contraseña. Un atacante puede enviar un número ilimitado de intentos erróneos de frase de contraseña contra cualquier dirección de correo electrónico conocida, limitado únicamente por el coste de verificación de Argon2 (aproximadamente 100 milisegundos por intento en el host probado, lo que permite 10 intentos por segundo de forma sostenida). El mismo backend implementa una limitación por cuenta funcional en el endpoint de desafío de WebAuthn, que devuelve HTTP 429 después de aproximadamente 19 intentos. La rama de frase de contraseña simplemente no invoca esa limitación, dejando una ruta de inicio de sesión de alto valor compatible desprotegida contra ataques de relleno de credenciales y ataques de diccionario. La asimetría confirma que esto es un descuido en lugar de una elección de diseño. La infraestructura de limitación existe, está conectada al mismo backend de autenticación y funciona en la ruta de WebAuthn. La rama de frase de contraseña en “/api/auth/login” no se actualizó para registrar los intentos fallidos. Combinado con la política de frase de contraseña mínima de la aplicación (12 caracteres, sin comprobaciones de entropía o diccionario), las cuentas que utilizan patrones base comunes como ’Spring2026!XX’ o palabras de un corpus de filtraciones son alcanzables de forma realista en días con una sola CPU, horas en una pequeña granja de GPU. La versión 1.0.2 corrige el problema. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 07, 2026
Action Type Old Value New Value Added Reference https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93 Added SSVC {'id': 'CVE-2026-48084', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-07T17:16:26.329156Z'} -
New CVE Received by [email protected]
Aug. 06, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'open-reception', 'product': 'appointment-booking-software', 'versions': [{'status': 'affected', 'version': '< 1.0.2'}]}] Added Description OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-307 Added Reference https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700 Added Reference https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93