CVE-2026-55879
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
OpenReplay versions 1.24.0 through 1.25.0 contain an XSS vulnerability allowing an unauthenticated attacker to take over a dashboard account. The attacker can inject a malicious script via custom event names or captured page URLs, which are stored in ClickHouse without output encoding and later rendered in the dashboard, enabling theft of the JWT token from localStorage.
Risk Assessment
The risk for the organization is the potential for complete dashboard account takeover by an unauthenticated attacker, leading to unauthorized access to sensitive session data and confidentiality breaches.
Recommendation
Immediately upgrade OpenReplay to version 1.25.0 or later, which includes a fix for the XSS vulnerability.
Original NVD description (English source)
OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.