A critical authentication bypass in OpenReception appointment booking software allows unauthenticated attackers to hijack user accounts by registering their own passkeys against victim profiles.

This is an improper authentication vulnerability (CWE-287) where the application fails to validate that the user ID provided during a WebAuthn registration request matches the authenticated user session. This permits an unauthenticated attacker to associate their own authenticator with a victim's account.

Successful exploitation results in full account takeover of any user on the platform, leading to unauthorized access to sensitive appointment data and personal information. Given the CVSS score of 9.8, this represents a critical risk to data confidentiality and integrity, potentially resulting in significant regulatory and reputational damage.

Immediate Action: Update OpenReception appointment-booking-software to version 1.0.2 or later immediately to enforce proper user ID validation during registration.

Proactive Monitoring: Review authentication logs for unusual registration patterns or multiple passkey associations occurring in rapid succession for a single account.

Compensating Controls: Implement a Web Application Firewall (WAF) to monitor and block suspicious POST requests directed at the /api/auth/register endpoint.

Public Exploit Available: Unknown

This is a critical vulnerability that enables complete account takeover. Administrators should prioritize patching to version 1.0.2 to close this authentication gap and protect user identities from compromise.