CVE-2026-48084

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48084", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:40:45.832Z", "datePublished": "2026-08-06T21:18:12.634Z", "dateUpdated": "2026-08-07T17:17:03.030Z"}, "containers": {"cna": {"title": "OpenReception doesn't rate limit passphrase login attempts", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93"}, {"name": "https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700"}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"version": "< 1.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:18:12.634Z"}, "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue."}], "source": {"advisory": "GHSA-hhg5-xmjg-3m93", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T17:16:26.329156Z", "id": "CVE-2026-48084", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:17:03.030Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48084", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:16:26.329156Z"}}}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:16:50.808Z"}}], "cna": {"title": "OpenReception doesn't rate limit passphrase login attempts", "source": {"advisory": "GHSA-hhg5-xmjg-3m93", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"status": "affected", "version": "< 1.0.2"}]}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93", "name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700", "name": "https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:18:12.634Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48084", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:17:03.030Z", "dateReserved": "2026-05-20T18:40:45.832Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T21:18:12.634Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "appointment-booking-software", "vendor": "open-reception", "versions": [{"status": "affected", "version": "< 1.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per second sustained). The same backend implements a working per-account throttle on the WebAuthn challenge endpoint, which returns HTTP 429 after roughly 19 attempts. The passphrase branch simply does not invoke that throttle, leaving a supported high-value login path unprotected against credential stuffing and dictionary attacks. The asymmetry confirms this is an oversight rather than a design choice. The throttle infrastructure exists, is wired into the same auth backend, and works on the WebAuthn path. The passphrase branch in `/api/auth/login` was not updated to record failed attempts. Combined with the application's minimum-passphrase policy (12 characters, no entropy or dictionary checks), accounts using common base patterns such as `Spring2026!XX` or words from a leak corpus are realistically reachable in days on a single CPU, hours on a small GPU farm. Version 1.0.2 patches the issue."}, {"lang": "es", "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Las versiones anteriores a la 1.0.2 no limitan los intentos fallidos de inicio de sesi\u00f3n con frase de contrase\u00f1a. Un atacante puede enviar un n\u00famero ilimitado de intentos err\u00f3neos de frase de contrase\u00f1a contra cualquier direcci\u00f3n de correo electr\u00f3nico conocida, limitado \u00fanicamente por el coste de verificaci\u00f3n de Argon2 (aproximadamente 100 milisegundos por intento en el host probado, lo que permite 10 intentos por segundo de forma sostenida). El mismo backend implementa una limitaci\u00f3n por cuenta funcional en el endpoint de desaf\u00edo de WebAuthn, que devuelve HTTP 429 despu\u00e9s de aproximadamente 19 intentos. La rama de frase de contrase\u00f1a simplemente no invoca esa limitaci\u00f3n, dejando una ruta de inicio de sesi\u00f3n de alto valor compatible desprotegida contra ataques de relleno de credenciales y ataques de diccionario. La asimetr\u00eda confirma que esto es un descuido en lugar de una elecci\u00f3n de dise\u00f1o. La infraestructura de limitaci\u00f3n existe, est\u00e1 conectada al mismo backend de autenticaci\u00f3n y funciona en la ruta de WebAuthn. La rama de frase de contrase\u00f1a en \u201c/api/auth/login\u201d no se actualiz\u00f3 para registrar los intentos fallidos. Combinado con la pol\u00edtica de frase de contrase\u00f1a m\u00ednima de la aplicaci\u00f3n (12 caracteres, sin comprobaciones de entrop\u00eda o diccionario), las cuentas que utilizan patrones base comunes como \u2019Spring2026!XX\u2019 o palabras de un corpus de filtraciones son alcanzables de forma realista en d\u00edas con una sola CPU, horas en una peque\u00f1a granja de GPU. La versi\u00f3n 1.0.2 corrige el problema."}], "id": "CVE-2026-48084", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48084", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T17:16:26.329156Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:11.297", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/commit/b283dbb670e09112299fb0cf89f3cb054ecc1700"}, {"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-hhg5-xmjg-3m93"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "appointment-booking-software", "source": "cna", "vendor": "open-reception"}, "product": "appointment-booking-software", "vendor": "open-reception"}], "created": "2026-08-07T00:30:06.734611+00:00", "updated": "2026-08-07T09:58:52.287312+00:00", "vendors": ["open-reception", "open-reception$PRODUCT$appointment-booking-software"]}