The vulnerability (CVE-2026-48084) in OpenReception's appointment booking software is an improper restriction of excessive authentication attempts (CWE-307). Versions before 1.0.2 fail to throttle failed passphrase login attempts, allowing attackers to submit unlimited guesses limited only by the Argon2 verification cost (~100 ms per attempt). The WebAuthn authentication path correctly enforces a per-account throttle returning HTTP 429 after about 19 attempts, but the passphrase login path does not invoke this throttle, indicating an oversight. This flaw enables credential stuffing and dictionary attacks against accounts with weak or common passphrases, which can be cracked in days on a single CPU or hours on a GPU farm. The issue is fixed in version 1.0.2.

Attackers can perform unlimited passphrase guesses against any known email address without being rate-limited, increasing the risk of account compromise through credential stuffing or dictionary attacks. This leads to high confidentiality and integrity impact as unauthorized access to user accounts is possible. Availability is not affected. The vulnerability has a CVSS score of 7.4 (high severity).

Upgrade OpenReception appointment booking software to version 1.0.2 or later, which patches the issue by implementing throttling on failed passphrase login attempts. Until upgraded, no other vendor-provided mitigations are indicated. Patch status is not explicitly stated but the description confirms version 1.0.2 fixes the vulnerability.