CVE-2026-48079

Received Received - Intake

Session Fixation in OpenReception Appointment Booking Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, the page's server-side load handler deletes the `access_token` cookie before calling `/api/auth/logout` via an internal `event.fetch()`. The internal fetch consequently runs without the auth cookie, so `apiAuthHandle` rejects it, the logout handler never executes, and `SessionService.revokeSession()` is never called for the current session. The DB session row remains valid until its natural expiry (one week by default). The user sees a successful logout (cookie gone, UI returns to login), but any party still holding a copy of the now-deleted access token can continue making authenticated API calls until the session naturally expires. The root cause is a simple ordering mistake. The same auth subsystem implements the correct order in `/api/auth/logout`: revoke the current DB session first, then delete the cookie. The page-level wrapper does the opposite. Version 1.0.2 initiates server-side logout before removing authentication cookies and first appears in version 1.0.2. Version 2.0.0 later replaces this with a race-free client-side logout flow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48079

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.0.2 (exc)
openreception	appointment_booking_software	1.0.2
openreception	appointment_booking_software	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability is in OpenReception's appointment booking software before version 1.0.2. When a user logs out, the system deletes the access token cookie before properly revoking the session in the database. This allows the session to remain active in the database even though the user appears logged out. Anyone with a copy of the deleted token can still make authenticated API calls until the session naturally expires after one week.

Detection Guidance

Check for active sessions in the database that should have been revoked after logout. Look for sessions older than expected or with unusual activity. Review server logs for failed logout attempts or API calls after logout. Verify cookie deletion timing matches the correct logout flow.

Impact Analysis

If you use this software, an attacker who obtains your access token before logout could continue accessing your account even after you log out. This could lead to unauthorized actions like viewing or modifying appointments, stealing sensitive data, or impersonating you until the session expires in one week.

Mitigation Strategies

Upgrade to version 1.0.2 or later where the logout flow is corrected. If upgrading is not possible, implement a manual session revocation process after logout. Monitor for unauthorized API access post-logout until the issue is resolved.

Hi! I’m here to help you understand CVE-2026-48079. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70