OpenReception's appointment booking software before version 1.0.2 contains an improper authentication vulnerability (CWE-287) in the registration handler at POST /api/auth/register/{userId}. The handler validates the WebAuthn challenge against the registration cookie's email but does not verify that the userId in the URL corresponds to that email. An attacker can request a challenge for their own email, generate a registration response with their own authenticator, and submit it against a victim's userId URL. Because the challenge and cookie email match, the WebAuthn ceremony succeeds, and the attacker's credential is written into the victim's user_passkey records. Consequently, the attacker can authenticate as the victim using their own passkey. User IDs are not strictly secret, and exposure surfaces should be assessed by maintainers. Version 1.0.2 addresses this vulnerability.

Successful exploitation allows an unauthenticated attacker to perform account takeover by registering their own WebAuthn credential under a victim's user ID, thereby bypassing authentication controls. This leads to full compromise of the victim's account, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.8 (critical).

Version 1.0.2 of OpenReception's appointment booking software fixes this vulnerability by properly validating that the userId in the registration URL matches the email associated with the registration cookie. Users and administrators should upgrade to version 1.0.2 or later to remediate this issue. No official patch link is provided; check the vendor's official channels for the update. Until patched, assess exposure of user IDs and restrict access to user ID information to reduce attack surface.