OpenReception appointment booking software before version 1.1.1 contains a missing authentication control in the POST /api/auth/passkeys endpoint. This endpoint accepts a userId and attacker-supplied passkey without requiring an authenticated session and does not verify registration properly. An attacker who knows the tenant ID and staff email can enumerate userIds via a public API and inject a public key for a candidate userId. By attempting login with the target email, the attacker can confirm the correct userId and then successfully authenticate as that staff member. This leads to creation of a staff session that exposes tenant data and tenant administrator identifiers. A compromised tenant administrator can alter or delete tenant resources and key shares, risking permanent data loss and service outage. The vulnerability is resolved in version 1.1.1.

An unauthenticated attacker can impersonate staff users by injecting credentials and bypassing authentication, gaining unauthorized access to tenant data. This access can escalate to tenant administrator privileges, enabling modification or deletion of critical tenant resources and key shares. Such actions can result in permanent loss of appointment data and disruption of booking services. Global administrator accounts are not accessible via this vulnerability. The CVSS 3.1 score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade OpenReception appointment booking software to version 1.1.1 or later, where this authentication bypass vulnerability is fixed. No other mitigations are indicated or required as the fix addresses the root cause.