Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical security vulnerability in the OpenReception appointment booking software, specifically within its registration handler. The flaw could allow an unauthenticated attacker to gain unauthorized access to user accounts by exploiting a weakness in how the system validates user identification during registration, potentially leading to account takeover if the attacker knows the victim's email and user ID. The main concern is confirming relevance and exposure given the potential for account compromise.
- Attacker can take over accounts using a booking system.
- Critical flaw impacts user registration and login.
- Assess system relevance and exposure immediately.
Attack Path
How an attacker could exploit the issue
An attacker can impersonate a victim and gain account access by exploiting a flaw in the registration process. The attacker starts by obtaining a WebAuthn challenge for their own email. They then craft a registration response using their own authenticator and submit it to any victim's registration URL. If the challenge matches the registration cookie's email, the system validates the WebAuthn ceremony and incorrectly associates the attacker's passkey with the victim's account. This allows the attacker to log in as the victim using their own authenticator.
- Unauthenticated access to registration API.
- Submitting crafted registration response to victim's URL.
- Account takeover and unauthorized session.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated attacker could gain unauthorized access to user accounts by exploiting a flaw in how the registration handler validates user IDs against authentication challenges. This could allow an attacker to associate their own authentication credential with a victim's account, enabling them to log in as that victim.
- User account takeover.
- Attacker submits valid passkey.
- Session takeover as victim.
Operational Fix
Recommended remediation, mitigation, and detection steps
The OpenReception appointment booking software's registration handler requires immediate attention, with the platform team likely responsible for initial discovery and assessment. The first practical step involves identifying all instances of the affected software, confirming their reachability and business criticality, and then pinpointing the accountable owner for remediation planning based on the identified risk.
- Platform team owns issue resolution.
- Verify software instances and reachability.
- Plan remediation based on risk assessment.
