# CVE-2026-48079: OpenReception appointment booking software session fixation via logout race condition

Source: https://junglewise.ai/threats/cve-2026-48079-openreception-appointment-booking-software-session-fixation-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48079 · Severity: high · CVSS 7.4 · Published 2026-08-06

OpenReception's appointment booking platform allows users to schedule appointments with end-to-end encryption. A logout implementation flaw causes server-side sessions to remain active for up to a week after a user clicks logout, enabling attackers who possess a copied access token to continue making authenticated API calls on behalf of the user even after the user believes they have logged out. This could allow unauthorized access to appointment data, calendar information, or personal details.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-48079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48079 being exploited in the wild.

**How severe is CVE-2026-48079?** High severity, with a CVSS score of 7.4, published 6 August 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software before 1.0.2.

**Is there a fix for CVE-2026-48079?** A patch was published on 2026-06-05: Version 1.0.2 fixes the logout order; version 2.0.0 implements client-side logout flow Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48079 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-48079?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a session fixation issue caused by an ordering bug in the logout handler. When a user navigates to the `/logout` page, the server-side handler deletes the `access_token` cookie before calling `/api/auth/logout` via `event.fetch()`. Because the cookie is removed first, the internal fetch request lacks authentication credentials, causing the API auth handler to reject it and `SessionService.revokeSession()` to never execute. The database session row remains valid until natural expiry (default: one week). An attacker who previously copied an access_token can continue making authenticated API calls until the session expires. The correct implementation (used by `/api/auth/logout` itself) revokes the session first, then deletes the cookie. The fix in version 1.0.2 corrects the operation order, and version 2.0.0 implements a race-free client-side logout flow. No authentication is required for the attacker to exploit a stolen token, and the attack is network-reachable.

## Affected products

- OpenReception appointment-booking-software before 1.0.2

## Timeline

- 2026-08-06: disclosed
- 2026-06-05: patched: Version 1.0.2 fixes the logout order; version 2.0.0 implements client-side logout flow

## References

- [https://github.com/open-reception/appointment-booking-software/commit/2419f9e87a8abad72f31b1fedeb80c758b30322e](https://github.com/open-reception/appointment-booking-software/commit/2419f9e87a8abad72f31b1fedeb80c758b30322e)
- [https://github.com/open-reception/appointment-booking-software/commit/f833dbf50059ff7d4ea42ce7bbb3a5cdcf7a6929](https://github.com/open-reception/appointment-booking-software/commit/f833dbf50059ff7d4ea42ce7bbb3a5cdcf7a6929)

## Related threats

- [OpenReception Appointment Booking unauthenticated ML-KEM key injection](https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software authentication bypass in PIN throttle](https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software invite token replay](https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)