CVE-2026-48084

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description The software fails to throttle failed passphrase login attempts, allowing an attacker to submit unlimited incorrect guesses against known email addresses. This occurs because the passphrase branch in the /api/auth/login endpoint does not invoke the existing throttle infrastructure used by other authentication paths. This oversight leaves accounts susceptible to dictionary attacks and credential stuffing, especially for users with common passphrase patterns. The rate of attempts is limited only by the Argon2 verification cost, which is a password hashing function designed to be computationally expensive to resist brute-force attacks.

Recommendations Update to version 1.0.2.