CVE-2026-48079 open-reception CVE debrief

Who should care

Defenders responsible for OpenReception's appointment booking software, security teams, and developers should be aware of this vulnerability and take necessary actions to prevent potential unauthorized API access.

Why it matters

CVE-2026-48079 is a high-severity vulnerability in OpenReception's appointment booking software that allows an attacker to continue making authenticated API calls even after a user logs out, until the session naturally expires. Defenders should prioritize verifying and applying the patch to prevent potential unauthorized API access.

• Potential unauthorized API access after logout
• Possible continued use of deleted access tokens until session expiration
• Need for verification and patch application to prevent exploitation

Technical summary

The vulnerability is caused by a simple ordering mistake in the `/logout` page's server-side load handler, which deletes the `access_token` cookie before calling `/api/auth/logout`. This allows an attacker to continue making authenticated API calls even after a user logs out, until the session naturally expires. The root cause is a simple ordering mistake. The same auth subsystem implements the correct order in `/api/auth/logout`: revoke the current DB session first, then delete the cookie. The page-level wrapper does the opposite. Version 1.0.2 initiates server-side logout before removing authentication cookies.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential unauthorized API access.

Recommended defensive actions

• Verify and apply the patch to prevent potential unauthorized API access
• Review and update logout handlers to ensure correct ordering of cookie deletion and API calls
• Monitor API calls for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a simple ordering mistake in the `/logout` page's server-side load handler, which deletes the `access_token` cookie before calling `/api/auth/logout`. This allows an attacker to continue making authenticated API calls even after a user logs out, until the session naturally expires. The DB session row remains valid until its natural expiry (one week by default). The user sees a successful logout (cookie gone, UI returns to login), but any party still holding a copy of the now-deleted access token can make

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.