The vulnerability (CVE-2026-48083) affects OpenReception's appointment booking software before version 1.0.2. The /api/log endpoint accepts unauthenticated POST requests without schema validation and writes attacker-controlled content directly to the application's stdout log. Newline characters are interpreted as line breaks, enabling log injection attacks that can forge legitimate-looking system events, mask attacker activity, or generate false SIEM alerts. Additionally, the endpoint enforces no size or rate limits, allowing denial of service through log volume saturation and oversized payload submissions. Version 1.0.2 addresses this issue.

An attacker can inject misleading log entries that appear as legitimate system errors, potentially confusing operators and polluting security monitoring systems. The lack of rate and size limits also allows denial of service by overwhelming the logging system with excessive requests or large payloads. There is no direct confidentiality impact, but integrity and availability of logging are affected.

Version 1.0.2 of OpenReception's appointment booking software fixes this vulnerability. Users should upgrade to version 1.0.2 or later to remediate the issue. No official patch link or advisory was provided, so verify upgrade availability with the vendor.