OpenReception's appointment booking software before version 1.0.2 contains a session management flaw where the logout page deletes the access token cookie before revoking the session in the database. Because the internal API call to revoke the session runs without authentication, it is rejected, leaving the session active until it naturally expires (one week by default). This allows an attacker or any party with the access token to continue making authenticated API calls despite the user seeing a logged-out state. The root cause is an incorrect order of operations in the logout handler. Version 1.0.2 fixes this by revoking the session before deleting cookies, and version 2.0.0 further improves logout with a race-free client-side flow.

An attacker or any party possessing a valid access token can continue to use it to make authenticated API requests even after the user logs out, because the session remains active in the backend until it expires naturally. This leads to a confidentiality and integrity impact, as unauthorized access to user data and actions is possible. Availability is not affected. The CVSS 3.1 score is 7.4 (high), reflecting network attack vector, high impact on confidentiality and integrity, but requiring high attack complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. However, the description states that version 1.0.2 corrects the logout sequence to revoke sessions before deleting cookies, effectively fixing the issue. Version 2.0.0 further improves logout handling. Until patched, users should be aware that logging out via the `/logout` page does not fully terminate sessions. No vendor advisory or official patch link is provided in the data; therefore, verify with the vendor for official fixes and apply updates accordingly.