CVE-2026-48079

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description An ordering error in the server-side load handler of the /logout page causes the access token cookie to be deleted before the /api/auth/logout endpoint is called via event.fetch(). Because the internal fetch lacks the authentication cookie, the apiAuthHandle rejects the request, preventing the SessionService.revokeSession() function from executing. Consequently, the session remains valid in the database until its natural expiry, allowing anyone with a copy of the token to continue making authenticated API calls despite the user appearing to have logged out.

Recommendations Update to version 1.0.2 or later.