CVE-2026-48083

Received Received - Intake

Log Injection Vulnerability in OpenReception Appointment Booking Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the application's stdout log, interprets newline characters as real line breaks, and enforces no size or rate limits. Three independent abuse modes follow: log injection (forge log lines that look like legitimate system events), log volume DoS (saturate the logging pipeline at sustained 100+ requests per second of small messages), and oversized-payload submission (100 KB payloads accepted; larger sizes not tested). The most operationally damaging mode is log injection. An attacker can inject lines that an operator scanning logs would mistake for real system errors, mask their own activity behind fake noise, or pollute SIEM alerting rules with crafted false positives. A line such as `[error]: injected admin error` injected from an unauthenticated source is indistinguishable from the application's own error output once written to disk. Version 1.0.2 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48083

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenReception's appointment booking software before version 1.0.2. The /api/log endpoint allows unauthenticated POST requests without schema validation. Attackers can inject arbitrary content into application logs, including newline characters that create fake log entries. This enables log injection, log volume denial of service, and oversized payload submissions.

Detection Guidance

Check for unusual log entries containing attacker-controlled content or excessive log volume. Monitor `/api/log` endpoint for unauthenticated POST requests. Look for log lines with suspicious patterns like `[error]: injected admin error` or repeated small payloads at high frequency.

Impact Analysis

An attacker could inject fake error messages that appear legitimate, making it difficult to identify real issues. They could also flood logs with excessive requests, causing system slowdowns or crashes. Additionally, large payloads might consume server resources or trigger security alerts.

Mitigation Strategies

Upgrade to OpenReception version 1.0.2 or later. Implement input validation and schema enforcement for the `/api/log` endpoint. Apply size and rate limits to POST requests. Disable unauthenticated access to the logging endpoint.

Hi! I’m here to help you understand CVE-2026-48083. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70