Appointment Booking Software
Monthly
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers inject a controlled WebAuthn credential for a guessed userId and then log in as that staff member, yielding a valid STAFF session without any credentials. The attacker only needs the tenant's public tenant ID and a target staff email address, plus reachability of the public booking API, to run an inject-then-login oracle that identifies the matching userId and completes authentication with their own assertion. Successful hijacking of a STAFF account exposes tenant data, and escalation to TENANT_ADMIN identifiers allows modification or deletion of tenant resources and key shares, which can render appointment data permanently undecryptable and take booking services offline; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. There is no public exploit identified at time of analysis, though the vendor has released a fix in version 1.1.1 and the code diff demonstrates the defect unambiguously.
Unauthenticated passkey enrollment in OpenReception appointment-booking software prior to 1.1.1 lets remote attackers inject a controlled WebAuthn credential for a guessed userId and then log in as that staff member, yielding a valid STAFF session without any credentials. The attacker only needs the tenant's public tenant ID and a target staff email address, plus reachability of the public booking API, to run an inject-then-login oracle that identifies the matching userId and completes authentication with their own assertion. Successful hijacking of a STAFF account exposes tenant data, and escalation to TENANT_ADMIN identifiers allows modification or deletion of tenant resources and key shares, which can render appointment data permanently undecryptable and take booking services offline; GLOBAL_ADMIN accounts are not reachable through this tenant-scoped path. There is no public exploit identified at time of analysis, though the vendor has released a fix in version 1.1.1 and the code diff demonstrates the defect unambiguously.