CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts
Attackers can brute-force user passphrases due to missing rate limiting on the login endpoint, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48084?
CVE-2026-48084 is a high-severity missing authorization vulnerability in open-reception appointment-booking-software, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue.
Weakness: CWE-307
Which versions are affected by CVE-2026-48084?
How do I fix CVE-2026-48084?
No fix has been published for CVE-2026-48084 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48084 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48084 exists.
Sources
Also known as GHSA-hhg5-xmjg-3m93.