Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Summary Endpoints that bind a TOTP secret POST /api/otpenroll or register a WebAuthn passkey POST /api/finishpasskeyregister for the current user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered outside the RequireSecureSession group. With...

CVE-2026-48087

OpenReception’s appointment booking software (before v1.0.2) is vulnerable in the /api/auth/register/{userId} flow. The handler validates the WebAuthn challenge against the registration cookie’s email but does not verify that the URL’s userId belongs to that email. An unauthenticated attacker can...