CVE-2026-48084 describes an improper restriction of excessive authentication attempts (CWE-307) in OpenReception's appointment booking software. Versions before 1.0.2 fail to throttle failed passphrase login attempts, allowing attackers to submit unlimited wrong passphrase guesses at a rate of about 10 attempts per second per CPU. The backend correctly throttles the WebAuthn challenge endpoint but does not apply this throttle to the passphrase login branch, indicating an oversight. The minimum passphrase policy requires 12 characters but lacks entropy or dictionary checks, making accounts with common patterns vulnerable to credential stuffing and dictionary attacks. Version 1.0.2 addresses this vulnerability by implementing appropriate throttling.

Attackers can perform high-rate brute-force or credential stuffing attacks on user accounts via the passphrase login path, potentially compromising account confidentiality and integrity. The vulnerability does not affect availability. The lack of throttling significantly reduces the time required to guess weak or common passphrases, increasing the risk of unauthorized access.

Version 1.0.2 of OpenReception's appointment booking software patches this issue by adding throttling to failed passphrase login attempts. Users and administrators should upgrade to version 1.0.2 or later to mitigate this vulnerability. No other mitigation is indicated or required as the vendor has provided an official fix.