EUVD-2026-82418Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fully unauthenticated network endpoint (PR:N) confirmed by the fix adding the first auth check; scriptable bounded oracle keeps AC:L; STAFF/TENANT_ADMIN takeover yields full C:H/I:H/A:H (key-share deletion makes data permanently undecryptable).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and does not bind enrollment to locals.user.id. An unauthenticated attacker who knows the public tenant ID and the target staff email can use the public booking bootstrap and GET /api/tenants/[id]/appointments/staff-public-keys to obtain candidate userId values. The attacker first causes UserService.addAdditionalPasskey to store a controlled public key for a candidate userId, then attempts login with the target email; the login check compares verificationResult.userId with the email-resolved account and reveals whether the injected credential belongs to that target. Repeating this injection-before-login sequence identifies the matching userId, and the normal login endpoint accepts the attacker's assertion for the stored key and creates a STAFF session. The session can expose tenant data and reveal TENANT_ADMIN identifiers for further takeover; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. A hijacked TENANT_ADMIN can modify or delete tenant resources and key shares, potentially making appointment data permanently undecryptable and taking booking services offline. This issue is fixed in version 1.1.1.
AnalysisAI
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers inject a controlled WebAuthn credential for a guessed userId and then log in as that staff member, yielding a valid STAFF session without any credentials. The attacker only needs the tenant's public tenant ID and a target staff email address, plus reachability of the public booking API, to run an inject-then-login oracle that identifies the matching userId and completes authentication with their own assertion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable remotely without authentication against any OpenReception appointment-booking instance prior to 1.1.1 whose booking API is network-reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is well-supported by the source code evidence: the pre-1.1.1 POST /api/auth/passkeys handler took `userId` from the request body, never checked `locals.user`, never called `WebAuthnService.verifyRegistration`, and never bound enrollment to the authenticated session - a textbook CWE-306 (missing authentication for a critical function). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade OpenReception appointment-booking software to version 1.1.1 or later, which restores session enforcement, challenge verification via WebAuthnService.verifyRegistration, and binding of the new credential to locals.user.id; see the advisory at https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-g233-m625-m3pc and the release at https://github.com/open-reception/appointment-booking-software/releases/tag/v1.1.1, with the underlying diffs in commits 5d29d9c1964ef7541a6e96d04d946c22f76eea00 and 93040884b783573dbf161723e508676327fdf0bf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenReception deployments and identify any instance running a version prior to 1.1.1; restrict or monitor the public booking API where feasible, review authentication and passkey enrollment logs for unexpected STAFF or TENANT_ADMIN sessions, and notify security and operations teams. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in TypeScript
View allJoplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Cross-tenant authorization bypass in TinaCMS self-hosted deployments allows any holder of a legitimate TinaCloud account
Authenticated clients on deepstream.io 10.1.0 can bypass record-write authorization and modify arbitrary protected recor
OS command injection in zosmaai's pi-llm-wiki through 0.11.7 lets an attacker who can invoke the wiki_capture_source MCP
Path traversal in decap-server's local proxy containment guard allows an unauthenticated attacker to read, write, or del
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Fee-sponsoring servers built on mppx before 0.8.2 can be induced by any client with access to the sponsorship endpoint t
Code escaping sandbox in the PraisonAI npm package's built-in codeMode tool (praisonai 1.4.0 through 1.7.1) lets anyone
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Remote code execution affects Univer v1.0.0-alpha.2 through its Uniscript feature: the UniscriptExecutionService.execute
Dokploy instances running versions prior to 0.29.13 disclose stored Git provider secrets - GitHub App private keys, OAut
Unauthenticated access to the AgentOS HTTP server shipped in the npm `praisonai` package (versions 1.6.0 through 1.7.1)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today