A highly critical vulnerability exists in OpenReception's appointment booking software, allowing an unauthenticated attacker to inject a WebAuthn passkey for a chosen user. The flaw is present in POST /api/auth/passkeys before version 1.1.1, where the system neither verifies the supplied credential with WebAuthnService.verifyRegistration nor ties the enrollment to the currently authenticated user's session. By forging a passkey tied to a target staff account, the attacker can then perform a login attempt that, if the verificationResult.userId matches the account derived from the target's email, succeeds and creates a STAFF session. The vulnerability thus enables full account takeover and, through the held session, permits access to tenant data and the privilege of becoming a TENANT_ADMIN. The affected tenants can modify or delete critical data, potentially making appointment records permanently unreadable and disrupting booking services. This addresses CWE‑306, which relates to missing authentication for privileged operations.

The vulnerability affects the open-reception:appointment-booking-software platform in all releases prior to version 1.1.1. The affected components include the API endpoints POST /api/auth/passkeys, GET /api/tenants/[id]/appointments/staff-public-keys, and the user management pathways that process added passkeys. Any deployment of the software that does not apply the v1.1.1 hotfix remains vulnerable. The software is delivered as a public web service; no specific operating system or platform was stated, so any environment hosting the app is potentially at risk.

The severity is CVSS 9.8, indicating critical risk. The EPSS score is below 1 %, suggesting low current exploitation likelihood, yet the simplicity of the attack (HTTP POST without authentication) and the high impact make it a significant threat. The vulnerability is not listed in the CISA KEV catalog. An attacker only requires knowledge of a public tenant ID and a target staff email, both of which are publicly visible through the booking bootstrap and the staff-public-keys endpoint. Once those are known, the attacker can inject a passkey, discover the correct userId, and log in to obtain staff or tenant‑admin privileges. Therefore, the overall risk is high and warrants immediate remediation.