OpenReception’s appointment booking platform exposes an unauthenticated POST endpoint at /api/log that accepts arbitrary payloads without schema validation or size limits, directly writes the raw content to stdout, and interprets newline characters as real line breaks. This allows an attacker to inject specially crafted log entries—using CRLF sequences—to mimic legitimate system events. By embedding forged error or status messages, an adversary can conceal actions, mislead operators into attributing malicious activity to benign events, or cause SIEM tools to fire false alarms based on injected noise.

The vulnerability exists in all versions of the OpenReception appointment booking software released prior to 1.0.2. Version 1.0.2 introduces the necessary fixes to enforce input validation, size limits, and authentication for the /api/log endpoint, thereby eliminating the described abuse modes.

The CVSS score of 6.5 indicates moderate severity, and although EPSS is not reported, the lack of authentication and rate limiting means any reachable instance is exposed to the described attacks. The vulnerability is not currently listed in CISA’s KEV catalog. Attack scenarios are most likely to occur over the public network, where a remote actor can send frequent POST requests, achieving either log injection or a log‑volume denial of service at sustained rates of over 100 requests per second.