CVE-2026-48087

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description The registration handler at the endpoint POST /api/auth/register/{userId} fails to validate that the userId provided in the URL corresponds to the email address associated with the registration cookie. An unauthenticated attacker can request a WebAuthn challenge for their own email, generate a registration response using their own authenticator, and submit it to a victim's URL. Because the system only validates the challenge against the cookie's email and not the userId, the addPasskey() function writes the attacker's credential into the victim's user passkey records. This allows the attacker to perform an account takeover by providing a passkey assertion that the system accepts as the victim, granting the attacker a session as that user.

Recommendations Update to version 1.0.2.