A critical authentication vulnerability in OpenReception appointment-booking-software allows unauthenticated attackers to hijack administrative sessions, posing a severe risk to data integrity and service availability.

This flaw involves a missing authentication check for critical functionality (CWE-306) within the POST /api/auth/passkeys endpoint. An unauthenticated attacker can inject a controlled public key for a target user and subsequently bypass authentication to establish a staff session.

The ability for an unauthenticated actor to hijack a staff or TENANT_ADMIN session presents a significant risk of unauthorized data access and manipulation. Successful exploitation could lead to the permanent loss of encrypted appointment data and the disruption of booking services, which may result in severe operational downtime and reputational damage. Given the CVSS score of 9.8, this vulnerability represents a critical threat to the confidentiality, integrity, and availability of the platform.

Immediate Action: Upgrade to version 1.1.1 or later immediately to incorporate the necessary authentication binding and validation logic.

Proactive Monitoring: Review access logs for suspicious patterns of repeated POST requests to /api/auth/passkeys or unusual login attempts associated with staff email addresses.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the /api/auth/passkeys and public booking endpoints to known, trusted IP ranges where possible.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the potential for complete account takeover, organizations must prioritize patching to version 1.1.1. Security teams should verify that the update is applied across all instances and perform a post-patch audit of user session logs to ensure no unauthorized activity occurred prior to the remediation.