CVE-2026-48081

Received Received - Intake

Stored XSS in OpenReception Appointment Booking Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href="javascript:...">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48081

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves a tenant admin in OpenReception's appointment booking software storing malicious javascript: URLs in tenant configuration fields like website, imprint, or privacyStatement. These URLs are rendered as clickable links on patient-facing pages without proper filtering. When patients click these links, the embedded JavaScript executes in the patient's browser, allowing attackers to read or alter patient form data before it is encrypted by the client-side system.

Detection Guidance

Check if your OpenReception software version is below 1.0.2. Inspect tenant configuration files for `javascript:` URLs in `website`, `imprint`, or `privacyStatement` fields. Review server responses from `/api/public` for unfiltered JavaScript links in patient-facing pages.

Impact Analysis

If you are a patient using OpenReception's software, this vulnerability could allow an attacker to steal your personal or medical form data entered on the website. The attacker could also modify the data before it is encrypted, potentially leading to incorrect information being submitted. This breaks the software's promise of end-to-end encryption and exposes your sensitive data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA compliance requirements as it enables unauthorized access to patient data. GDPR mandates strict protection of personal data, while HIPAA requires safeguards for protected health information. The breach of end-to-end encryption and exposure of plaintext data before encryption directly conflicts with these regulations.

Mitigation Strategies

Upgrade OpenReception to version 1.0.2 or later. Remove any `javascript:` URLs from tenant `links` configuration. Audit all tenant configurations for similar issues. Monitor for unusual patient form data access patterns.

Hi! I’m here to help you understand CVE-2026-48081. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70