Read the docs
TI-2026-35522 Aliases CVE-2026-48081

OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer

Priority HIGH 70CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href="javascript:...">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed appointment-booking-software (open-reception): 1.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-receptionappointment-booking-softwarebefore 1.0.21.0.2Patch availableCNA
  • appointment-booking-software Vendoropen-reception Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA

Remediation

  • Fix · CNA appointment-booking-software (open-reception) Fixed in 1.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48081

References

Other 2

  • TI-2026-35529 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory CVSS 3.1CRITICAL 9.4
  • TI-2026-35528 OpenReception: WebAuthn passkey injection allows account takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-35526 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap CVSS 3.1CRITICAL 9.8
  • TI-2026-35527 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN CVSS 3.1CRITICAL 9.9
  • TI-2026-79990 Host header poisoning in OpenReception enables account takeover CVSS 3.1HIGH 8.3
  • TI-2026-35521 Information disclosure in open-reception appointment-booking-software CVSS 3.1HIGH 8.0
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences