Executive brief
OpenReception's appointment booking software provides encrypted appointment scheduling for businesses. An unauthenticated attacker can enroll malicious passkeys without proper verification, then use this to impersonate staff members and gain access to sensitive tenant data, including ability to delete or modify appointment records and encryption keys, rendering booking services offline.
Technical details
The vulnerability is an authentication bypass in the POST /api/auth/passkeys endpoint. The endpoint accepts user-supplied passkeys and userId in the request body without an authenticated session, fails to call WebAuthnService.verifyRegistration, and does not bind the enrolled credential to the actual user account. An attacker can enumerate valid userId values by exploiting public APIs (GET /api/tenants/[id]/appointments/staff-public-keys) combined with known email addresses, then inject a controlled passkey for a target account. By repeating injection and login attempts, the attacker determines which userId matches the target, then uses the stored malicious passkey to create an authenticated STAFF session. From this session, the attacker can access tenant data and escalate to TENANT_ADMIN roles, enabling data destruction or service disruption. The fix was released in version 1.1.1 and adds proper WebAuthn verification.
Affected products
- OpenReception Appointment Booking Software prior to 1.1.1
Timeline
- 2026-06-04: patched: Security fix merged in version 1.1.1
- 2026-09-17: disclosed