OpenReception’s appointment booking platform allows passphrase authentication without any rate limiting, letting an attacker submit unlimited incorrect passwords. The minimum 12‑character requirement offers little real entropy, so common patterns or leaked word lists can be guessed in days on a single CPU or hours on a small GPU farm. If an attacker succeeds, the compromised credentials grant full access to the protected booking interface, exposing sensitive client data and potentially enabling further lateral movement within the organization. The flaw stems from an oversight in the authentication backend and is categorized as CWE‑307, a security misconfiguration that permits credential stuffing attacks.

Vendors impacted include OpenReception’s appointment‑booking software. All releases prior to version 1.0.2 are affected; the patch in 1.0.2 installs the missing throttling logic for the passphrase login path. No other products or versions were listed in the advisory.

The CVSS score of 7.4 indicates a high severity vulnerability. Although an EPSS score is not available, the design allows attackers to test arbitrary passwords against any known email address, making exploitation likely when the service is exposed to the internet. The vulnerability is not listed in the CISA KEV catalog, but the absence of rate limiting creates a clear and straightforward attack vector: repeatedly sending requests to /api/auth/login from a remote host. Successful exploitation would compromise account secrecy and could facilitate additional attacks if the victim’s account is used for other services.