CVE-2026-48079: CWE-613: Insufficient Session Expiration in open-reception appointment-booking-software
OpenReception appointment booking software versions prior to 1.0.2 have an insufficient session expiration vulnerability. When users log out via the /logout page, the session revocation is not properly executed due to a server-side ordering error, leaving the session valid until its natural expiry. This allows an attacker with a copied access token to continue making authenticated API calls despite the user seeing a successful logout. The issue is fixed starting with version 1.0.2, which correctly revokes the session before deleting authentication cookies.
AI Analysis
Technical Summary
CVE-2026-48079 describes an insufficient session expiration vulnerability (CWE-613) in OpenReception's appointment booking software prior to version 1.0.2. The logout page's server-side load handler deletes the access_token cookie before calling the internal API logout endpoint, causing the logout handler to reject the request due to missing authentication and thus never revoking the session in the database. Consequently, the session remains active until its natural expiration (one week by default), allowing continued authenticated API access with a copied token. Version 1.0.2 corrects this by initiating server-side logout before removing cookies, and version 2.0.0 replaces the flow with a race-free client-side logout.
Potential Impact
An attacker or any party holding a copy of a user's access token can continue to make authenticated API calls after the user logs out via the /logout page, because the session is not revoked immediately. This undermines the logout process and can lead to unauthorized access until the session naturally expires, which is one week by default. The confidentiality and integrity of user sessions are impacted, but availability is not affected.
Mitigation Recommendations
Upgrade to OpenReception appointment booking software version 1.0.2 or later, where the logout process correctly revokes the session before deleting authentication cookies. Version 2.0.0 further improves the logout flow with a race-free client-side implementation. Until upgrading, be aware that logout via the /logout page does not fully terminate sessions server-side.
CVE-2026-48079: CWE-613: Insufficient Session Expiration in open-reception appointment-booking-software
Description
OpenReception appointment booking software versions prior to 1.0.2 have an insufficient session expiration vulnerability. When users log out via the /logout page, the session revocation is not properly executed due to a server-side ordering error, leaving the session valid until its natural expiry. This allows an attacker with a copied access token to continue making authenticated API calls despite the user seeing a successful logout. The issue is fixed starting with version 1.0.2, which correctly revokes the session before deleting authentication cookies.
CVSS v3.1
Score 7.4high
Affected software
open-reception
appointment-booking-software
pkg:github/open-reception/appointment-booking-softwareRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48079 describes an insufficient session expiration vulnerability (CWE-613) in OpenReception's appointment booking software prior to version 1.0.2. The logout page's server-side load handler deletes the access_token cookie before calling the internal API logout endpoint, causing the logout handler to reject the request due to missing authentication and thus never revoking the session in the database. Consequently, the session remains active until its natural expiration (one week by default), allowing continued authenticated API access with a copied token. Version 1.0.2 corrects this by initiating server-side logout before removing cookies, and version 2.0.0 replaces the flow with a race-free client-side logout.
Potential Impact
An attacker or any party holding a copy of a user's access token can continue to make authenticated API calls after the user logs out via the /logout page, because the session is not revoked immediately. This undermines the logout process and can lead to unauthorized access until the session naturally expires, which is one week by default. The confidentiality and integrity of user sessions are impacted, but availability is not affected.
Mitigation Recommendations
Upgrade to OpenReception appointment booking software version 1.0.2 or later, where the logout process correctly revokes the session before deleting authentication cookies. Version 2.0.0 further improves the logout flow with a race-free client-side implementation. Until upgrading, be aware that logout via the /logout page does not fully terminate sessions server-side.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:25:25.709Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a750704bf8831d5395f5a63
Added to database: 08/06/2026, 22:13:24 UTC
Last enriched: 08/14/2026, 16:05:19 UTC
Last updated: 09/17/2026, 22:01:35 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.