The vulnerability in OpenReception appointment-booking-software (CVE-2026-48083) involves improper output neutralization for logs (CWE-117). The /api/log endpoint accepts unauthenticated POST requests with attacker-controlled content that is written directly to stdout logs without validation or sanitization. Newline characters are interpreted as line breaks, enabling attackers to forge log lines that appear as legitimate system events. This can mislead operators, mask malicious activity, and pollute SIEM alerts with false positives. Additionally, the endpoint enforces no size or rate limits, allowing denial of service through log volume saturation and oversized payload submissions. The issue is fixed in version 1.0.2.

The vulnerability allows unauthenticated attackers to inject forged log entries that can confuse operators and security monitoring systems, potentially hiding malicious activity or generating false alerts. It also enables denial of service by overwhelming the logging system with high volumes of requests or large payloads. There is no direct confidentiality impact, but integrity and availability of logging are affected.

A fix is available in OpenReception appointment-booking-software version 1.0.2. Users should upgrade to version 1.0.2 or later to remediate this vulnerability. Until upgraded, restricting access to the /api/log endpoint and implementing input validation or rate limiting may reduce risk, but the official fix is recommended.