CVE-2026-55879
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
OpenReplay versions 1.24.0 through 1.25.0 contain an XSS vulnerability allowing an unauthenticated attacker to take over a dashboard account. The attacker can inject a malicious script via custom event names or captured page URLs, which are stored in ClickHouse without output encoding and later rendered in the dashboard, enabling theft of the JWT token from localStorage.
Risk Assessment
The risk for the organization is the potential for complete dashboard account takeover by an unauthenticated attacker, leading to unauthorized access to sensitive session data and confidentiality breaches.
Recommendation
Immediately upgrade OpenReplay to version 1.25.0 or later, which includes a fix for the XSS vulnerability.
Other vulnerabilities in OpenReplay
See all- CVE-2026-57230Medium
A vulnerability in OpenReplay before version 1.27.0 allows an authenticated user to read any ClickHouse table via SQL injection in the session search and analytics API. The attacker can perform blind boolean and time-based data exfiltration and disrupt session search for all users.
- CVE-2026-55881High
A vulnerability in OpenReplay allows an authenticated low-privilege user to read the first 15 seconds of session replay data from another tenant. The issue stems from missing validation that the session belongs to the project when generating presigned download URLs.
- CVE-2026-55880High
In OpenReplay versions 1.27.0 and earlier, three mutation functions (notes.delete, dashboards.update_widget, dashboards.remove_widget) did not check resource ownership, allowing any authenticated user to delete other users' private session notes and modify widgets on their private dashboards.
Original NVD description (English source)
OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.