Session Management Vulnerability in OpenReception's Appointment Booking Software

CVE-2026-48079

What is CVE-2026-48079?

OpenReception's appointment booking software has a vulnerability affecting session management. Before version 1.0.2, navigating to the /logout page would inadvertently delete the access_token cookie before properly handling the logout process on the server side. This misordering means that while users see a successful logout, attackers holding a copy of the deleted access token can continue to access authenticated APIs until the session naturally expires, leaving a window for unauthorized API calls. The issue has been addressed in later versions by correcting the order of operations, ensuring the session revocation happens before cookie deletion.

References