CVE-2026-48079

OpenReception’s OpenReception appointment-booking software before v1.0.2 suffers a logout-order flaw: the logout page deletes the access_token cookie before invoking the server-side logout. As a result, internal fetches for /api/auth/logout run without the auth cookie, so apiAuthHandle rejects th...