The flaw occurs during WebAuthn registration because the endpoint that receives a registration request does not verify that the user identifier supplied in the URL belongs to the email address claimed by the WebAuthn challenge. An attacker who can obtain a victim’s email address and user identifier can therefore register a passkey that is written into the victim’s account. Subsequent logins that use the attacker’s authenticator are accepted as if the victim had authenticated, giving the attacker full control over the victim’s account. This is a classic authentication bypass (CWE‑287).

Versions of OpenReception appointment booking software released before 1.0.2 are affected. The vulnerability resides in the POST /api/auth/register/{userId} endpoint, which fails to bind the userId in the URL to the email address used for the WebAuthn challenge. User identifiers are not intrinsically secret in this platform, meaning they can potentially be exposed through various API routes, which further lowers the barrier to exploitation.

The CVSS score of 9.8 marks this issue as critical. An attacker can carry out the exploitation remotely over HTTP without any prior authentication, provided they know the victim’s email address and corresponding user identifier. Because user identifiers are not masked, the attack is easier to perform once the attacker has discovered how to obtain them. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog.