CVE-2026-48081

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description A TENANT ADMIN can store javascript: URLs within the tenant links configuration, specifically in the website, imprint, and privacyStatement variables. These values are returned to the patient-facing landing page through the /api/public endpoint and rendered as anchor elements without URL-scheme filtering. A patient clicking these links triggers the execution of arbitrary JavaScript within the patient browser origin. This allows the attacker to read or alter plaintext patient form data before client-side encryption is applied, compromising the platform's end-to-end encryption trust model.

Recommendations Update to version 1.0.2.