CVE-2026-48079: OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal event.fetch(). The internal fetch consequently runs without the auth cookie, so apiAuthHandle rejects it, the logout handler never executes, and SessionService.revokeSession() is never called for the current session. The DB session row remains valid until its natural expiry (one week by default). The user sees a successful logout (cookie gone, UI returns to login), but any party still holding a copy of the now-deleted access token can continue making authenticated API calls until the session naturally expires. The root cause is a simple ordering mistake. The same auth subsystem implements the correct order in /api/auth/logout: revoke the current DB session first, then delete the cookie. The page-level wrapper does the opposite. Version 1.0.2 initiates server-side logout before removing authentication cookies and first appears in version 1.0.2. Version 2.0.0 later replaces this with a race-free client-side logout flow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenReception appointment booking softwareto a version that resolves this vulnerability.Fixed in 1.0.2 - Upgrade
Upgrade
OpenReception appointment booking softwareto a version that resolves this vulnerability.Fixed in 2.0.0 - Configuration
Change the `/logout` handler so it executes the logout flow in the same order as `/api/auth/logout`: call server-side session revocation (SessionService.revokeSession()) before deleting the `access_token` cookie. This prevents duplicated/stale tokens from remaining valid until natural expiry.
OpenReception /logout server-side load handler logout operation order (revoke session vs delete access_token cookie) = Revoke the current DB session first, then delete the `access_token` cookie (race-free ordering) - Configuration
Ensure `/api/auth/logout` performs session revocation before removing authentication cookies, as described. This fixes the ordering mistake that prevented logout from executing when the cookie was deleted before the internal `event.fetch()`.
OpenReception /api/auth/logout logout operation order (revoke session vs delete access_token cookie) = Revoke DB session first, then delete cookie
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48079?
CVE-2026-48079 has a severity rating of high at 7.4.
How do I fix CVE-2026-48079?
To fix CVE-2026-48079, upgrade to version 1.0.2 or later of OpenReception's appointment booking software.
What are the potential impacts of CVE-2026-48079?
CVE-2026-48079 allows duplicated access tokens to remain valid until they expire, potentially compromising user session security.
Which versions are affected by CVE-2026-48079?
CVE-2026-48079 affects versions of OpenReception prior to 1.0.2.
Is there a workaround for CVE-2026-48079 before applying the patch?
There is no documented workaround for CVE-2026-48079; upgrading to the fixed version is recommended.