Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, the page's server-side load handler deletes the `access_token` cookie before calling `/api/auth/logout` via an internal `event.fetch()`. The internal fetch consequently runs without the auth cookie, so `apiAuthHandle` rejects it, the logout handler never executes, and `SessionService.revokeSession()` is never called for the current session. The DB session row remains valid until its natural expiry (one week by default). The user sees a successful logout (cookie gone, UI returns to login), but any party still holding a copy of the now-deleted access token can continue making authenticated API calls until the session naturally expires. The root cause is a simple ordering mistake. The same auth subsystem implements the correct order in `/api/auth/logout`: revoke the current DB session first, then delete the cookie. The page-level wrapper does the opposite. Version 1.0.2 initiates server-side logout before removing authentication cookies and first appears in version 1.0.2. Version 2.0.0 later replaces this with a race-free client-side logout flow.
Published: 2026-08-06
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the logout page’s logic: the access_token cookie is deleted before the internal call to the backend logout endpoint. Because the token is no longer sent, the server rejects the logout request and the database session stays active for its normal lifetime (one week by default). Consequently, any party that still holds the now‑deleted token can continue to authenticate API calls until the session naturally expires, allowing unauthorized data access but not arbitrary code execution or privilege escalation.

Affected Systems

OpenReception’s appointment booking software, all releases older than version 1.0.2, is affected. Version 1.0.2 fixes the ordering, and version 2.0.0 replaces the flow with a race‑free client‑side logout. The issue manifests on the /logout page and any other paths that clear the cookie before revoking the session.

Risk and Exploitability

The CVSS score of 7.4 places the vulnerability in the high‑severity range. With no EPSS data or KEV listing, the risk is quantified by the content of the description rather than exploitation prevalence. An attacker must first obtain a valid access token—by theft, interception, or reuse from a prior session—and can then replay authenticated API requests until the session expires. The exploitation requires no special network privileges; possession of the token is sufficient. The extended validity window amplifies the potential impact for attackers who retain the token.

Generated by OpenCVE AI on August 7, 2026 at 00:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to version 1.0.2 or later, which reverses the logout order to revoke the database session before deleting the cookie.
  • If upgrading is not immediately possible, alter the /logout handler so that the internal /api/auth/logout endpoint is called before the authentication cookie is removed, or add middleware that ensures session revocation precedes cookie deletion.
  • Reduce the session lifetime or invoke an explicit session‑revocation API immediately after logout to shorten the window during which the token remains valid.

Generated by OpenCVE AI on August 7, 2026 at 00:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Open-reception
Open-reception appointment-booking-software
Vendors & Products Open-reception
Open-reception appointment-booking-software

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, the page's server-side load handler deletes the `access_token` cookie before calling `/api/auth/logout` via an internal `event.fetch()`. The internal fetch consequently runs without the auth cookie, so `apiAuthHandle` rejects it, the logout handler never executes, and `SessionService.revokeSession()` is never called for the current session. The DB session row remains valid until its natural expiry (one week by default). The user sees a successful logout (cookie gone, UI returns to login), but any party still holding a copy of the now-deleted access token can continue making authenticated API calls until the session naturally expires. The root cause is a simple ordering mistake. The same auth subsystem implements the correct order in `/api/auth/logout`: revoke the current DB session first, then delete the cookie. The page-level wrapper does the opposite. Version 1.0.2 initiates server-side logout before removing authentication cookies and first appears in version 1.0.2. Version 2.0.0 later replaces this with a race-free client-side logout flow.
Title OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
Weaknesses CWE-613
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Open-reception Appointment-booking-software
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T17:11:36.655Z

Reserved: 2026-05-20T18:25:25.709Z

Link: CVE-2026-48079

cve-icon Vulnrichment

Updated: 2026-08-07T17:11:00.306Z

cve-icon NVD

Status : Received

Published: 2026-08-06T22:17:10.557

Modified: 2026-08-07T18:17:17.813

Link: CVE-2026-48079

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T09:58:59Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration