Is CVE-2026-48081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48081 being exploited in the wild.

How severe is CVE-2026-48081?

High severity, with a CVSS score of 8.1, published 6 August 2026.

Which products and versions are affected?

OpenReception Appointment-Booking-Software prior to 1.0.2.

Is there a fix for CVE-2026-48081?

A patch was published on 2026-05-20: Version 1.0.2 released with fixes to validate URL schemes in tenant links Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48081 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48081?

Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48081: OpenReception stored XSS via javascript: tenant links

CVE-2026-48081 · Severity: high · CVSS 8.1 · Published 2026-08-06

OpenReception is an appointment booking platform that promises end-to-end encryption so that administrators cannot read patient data. However, before version 1.0.2, administrators could inject malicious JavaScript links into the platform's configuration that would execute in patients' browsers. When a patient clicks these links, the attacker's code runs in the patient's session and can steal personal information from the booking form before encryption is applied, directly breaking the platform's core security guarantee.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-48081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48081 being exploited in the wild.
How severe is CVE-2026-48081?: High severity, with a CVSS score of 8.1, published 6 August 2026.
Which products and versions are affected?: OpenReception Appointment-Booking-Software prior to 1.0.2.
Is there a fix for CVE-2026-48081?: A patch was published on 2026-05-20: Version 1.0.2 released with fixes to validate URL schemes in tenant links Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48081 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48081?: Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability that stems from insufficient input validation on tenant configuration. A TENANT_ADMIN can inject javascript: protocol URLs into the tenant links configuration (website, imprint, privacyStatement fields) via the /api/tenants endpoint without scheme validation. These malicious URLs are then returned to unauthenticated patients via the /api/public endpoint, hydrated into a SvelteKit Button component, and rendered as href attributes in anchor tags without URL-scheme filtering. When a patient clicks the link, the JavaScript executes in the patient browser origin with access to the patient's form data before client-side encryption is applied. The vulnerability affects the patient-facing landing page, login flow, and booking flow. The attack requires a malicious TENANT_ADMIN but can compromise any patient who interacts with the affected appointment booking platform. Version 1.0.2 includes fixes to validate and reject javascript: URLs in link configuration.

Affected products

OpenReception appointment-booking-software prior to 1.0.2

Timeline

2026-05-20: disclosed: GitHub Security Advisory GHSA-xpr7-wx69-mp36 published
2026-05-20: patched: Version 1.0.2 released with fixes to validate URL schemes in tenant links

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.