Executive brief
OpenReception's appointment booking platform allows users to schedule appointments with end-to-end encryption. A logout implementation flaw causes server-side sessions to remain active for up to a week after a user clicks logout, enabling attackers who possess a copied access token to continue making authenticated API calls on behalf of the user even after the user believes they have logged out. This could allow unauthorized access to appointment data, calendar information, or personal details.
Technical details
The vulnerability is a session fixation issue caused by an ordering bug in the logout handler. When a user navigates to the `/logout` page, the server-side handler deletes the `access_token` cookie before calling `/api/auth/logout` via `event.fetch()`. Because the cookie is removed first, the internal fetch request lacks authentication credentials, causing the API auth handler to reject it and `SessionService.revokeSession()` to never execute. The database session row remains valid until natural expiry (default: one week). An attacker who previously copied an access_token can continue making authenticated API calls until the session expires. The correct implementation (used by `/api/auth/logout` itself) revokes the session first, then deletes the cookie. The fix in version 1.0.2 corrects the operation order, and version 2.0.0 implements a race-free client-side logout flow. No authentication is required for the attacker to exploit a stolen token, and the attack is network-reachable.
Affected products
- OpenReception appointment-booking-software before 1.0.2
Timeline
- 2026-08-06: disclosed
- 2026-06-05: patched: Version 1.0.2 fixes the logout order; version 2.0.0 implements client-side logout flow