Quick answers
- Is CVE-2026-48079 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48079 being exploited in the wild.
- How severe is CVE-2026-48079?
- High severity, with a CVSS score of 7.4, published 6 August 2026.
- Which products and versions are affected?
- OpenReception Appointment-Booking-Software before 1.0.2.
- Is there a fix for CVE-2026-48079?
- A patch was published on 2026-06-05: Version 1.0.2 fixes the logout order; version 2.0.0 implements client-side logout flow Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48079 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-48079?
- Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a session fixation issue caused by an ordering bug in the logout handler. When a user navigates to the `/logout` page, the server-side handler deletes the `access_token` cookie before calling `/api/auth/logout` via `event.fetch()`. Because the cookie is removed first, the internal fetch request lacks authentication credentials, causing the API auth handler to reject it and `SessionService.revokeSession()` to never execute. The database session row remains valid until natural expiry (default: one week). An attacker who previously copied an access_token can continue making authenticated API calls until the session expires. The correct implementation (used by `/api/auth/logout` itself) revokes the session first, then deletes the cookie. The fix in version 1.0.2 corrects the operation order, and version 2.0.0 implements a race-free client-side logout flow. No authentication is required for the attacker to exploit a stolen token, and the attack is network-reachable.
Affected products
- OpenReception appointment-booking-software before 1.0.2
Timeline
- 2026-08-06: disclosed
- 2026-06-05: patched: Version 1.0.2 fixes the logout order; version 2.0.0 implements client-side logout flow