CVE-2026-48083

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description The /api/log endpoint accepts unauthenticated POST requests without schema validation of the message body. This allows attacker-controlled content to be written directly into the application's stdout log, where newline characters are interpreted as real line breaks and no size or rate limits are enforced. This leads to three abuse modes: log injection, where attackers forge log lines to mimic legitimate system events or pollute SIEM (Security Information and Event Management) alerting rules; log volume DoS, which saturates the logging pipeline; and oversized-payload submission. Log injection is the most damaging mode as it allows attackers to mask activity or create fake system errors indistinguishable from actual application output.

Recommendations Update to version 1.0.2. As a temporary workaround, restrict access to the /api/log endpoint to minimize the risk of exploitation.