# CVE-2026-54460: OpenReception Appointment Booking Software authentication bypass in passkey enrollment

Source: https://junglewise.ai/threats/cve-2026-54460-openreception-appointment-booking-software-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54460 · Severity: critical · CVSS 9.8 · Published 2026-09-17

OpenReception's appointment booking software provides encrypted appointment scheduling for businesses. An unauthenticated attacker can enroll malicious passkeys without proper verification, then use this to impersonate staff members and gain access to sensitive tenant data, including ability to delete or modify appointment records and encryption keys, rendering booking services offline.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-54460 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54460 being exploited in the wild.

**How severe is CVE-2026-54460?** Critical severity, with a CVSS score of 9.8, published 17 September 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software prior to 1.1.1.

**Is there a fix for CVE-2026-54460?** A patch was published on 2026-06-04: Security fix merged in version 1.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54460 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54460?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the POST /api/auth/passkeys endpoint. The endpoint accepts user-supplied passkeys and userId in the request body without an authenticated session, fails to call WebAuthnService.verifyRegistration, and does not bind the enrolled credential to the actual user account. An attacker can enumerate valid userId values by exploiting public APIs (GET /api/tenants/[id]/appointments/staff-public-keys) combined with known email addresses, then inject a controlled passkey for a target account. By repeating injection and login attempts, the attacker determines which userId matches the target, then uses the stored malicious passkey to create an authenticated STAFF session. From this session, the attacker can access tenant data and escalate to TENANT_ADMIN roles, enabling data destruction or service disruption. The fix was released in version 1.1.1 and adds proper WebAuthn verification.

## Affected products

- OpenReception Appointment Booking Software prior to 1.1.1

## Timeline

- 2026-06-04: patched: Security fix merged in version 1.1.1
- 2026-09-17: disclosed

## References

- [https://github.com/open-reception/appointment-booking-software/commit/5d29d9c1964ef7541a6e96d04d946c22f76eea00](https://github.com/open-reception/appointment-booking-software/commit/5d29d9c1964ef7541a6e96d04d946c22f76eea00)
- [https://github.com/open-reception/appointment-booking-software/commit/93040884b783573dbf161723e508676327fdf0bf](https://github.com/open-reception/appointment-booking-software/commit/93040884b783573dbf161723e508676327fdf0bf)

## Related threats

- [OpenReception Appointment Booking unauthenticated ML-KEM key injection](https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software authentication bypass in PIN throttle](https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software invite token replay](https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)