Executive brief
OpenReception is an appointment booking platform that promises end-to-end encryption so that administrators cannot read patient data. However, before version 1.0.2, administrators could inject malicious JavaScript links into the platform's configuration that would execute in patients' browsers. When a patient clicks these links, the attacker's code runs in the patient's session and can steal personal information from the booking form before encryption is applied, directly breaking the platform's core security guarantee.
Technical details
This is a stored cross-site scripting (XSS) vulnerability that stems from insufficient input validation on tenant configuration. A TENANT_ADMIN can inject javascript: protocol URLs into the tenant links configuration (website, imprint, privacyStatement fields) via the /api/tenants endpoint without scheme validation. These malicious URLs are then returned to unauthenticated patients via the /api/public endpoint, hydrated into a SvelteKit Button component, and rendered as href attributes in anchor tags without URL-scheme filtering. When a patient clicks the link, the JavaScript executes in the patient browser origin with access to the patient's form data before client-side encryption is applied. The vulnerability affects the patient-facing landing page, login flow, and booking flow. The attack requires a malicious TENANT_ADMIN but can compromise any patient who interacts with the affected appointment booking platform. Version 1.0.2 includes fixes to validate and reject javascript: URLs in link configuration.
Affected products
- OpenReception appointment-booking-software prior to 1.0.2
Timeline
- 2026-05-20: disclosed: GitHub Security Advisory GHSA-xpr7-wx69-mp36 published
- 2026-05-20: patched: Version 1.0.2 released with fixes to validate URL schemes in tenant links