CVE-2026-48084

{
  "id": "CVE-2026-48084",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:17:11.297",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue."
    },
    {
      "lang": "es",
      "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Las versiones anteriores a la 1.0.2 no limitan los intentos fallidos de inicio de sesión con frase de contraseña. Un atacante puede enviar un número ilimitado de intentos erróneos de frase de contraseña contra cualquier dirección de correo electrónico conocida, limitado únicamente por el coste de verificación de Argon2 (aproximadamente 100 milisegundos por intento en el host probado, lo que permite 10 intentos por segundo de forma sostenida). El mismo backend implementa una limitación por cuenta funcional en el endpoint de desafío de WebAuthn, que devuelve HTTP 429 después de aproximadamente 19 intentos. La rama de frase de contraseña simplemente no invoca esa limitación, dejando una ruta de inicio de sesión de alto valor compatible desprotegida contra ataques de relleno de credenciales y ataques de diccionario. La asimetría confirma que esto es un descuido en lugar de una elección de diseño. La infraestructura de limitación existe, está conectada al mismo backend de autenticación y funciona en la ruta de WebAuthn. La rama de frase de contraseña en “/api/auth/login” no se actualizó para registrar los intentos fallidos. Combinado con la política de frase de contraseña mínima de la aplicación (12 caracteres, sin comprobaciones de entropía o diccionario), las cuentas que utilizan patrones base comunes como ’Spring2026!XX’ o palabras de un corpus de filtraciones son alcanzables de forma realista en días con una sola CPU, horas en una pequeña granja de GPU. La versión 1.0.2 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "open-reception",
          "product": "appointment-booking-software",
          "versions": [
            {
              "version": "< 1.0.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T17:16:26.329156Z",
          "id": "CVE-2026-48084",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}