OpenReplay vulnerabilities

OpenReplay versions 1.24.0 through 1.25.0 contain an XSS vulnerability allowing an unauthenticated attacker to take over a dashboard account. The attacker can inject a malicious script via custom event names or captured page URLs, which are stored in ClickHouse without output encoding and later rendered in the dashboard, enabling theft of the JWT token from localStorage.

A vulnerability in OpenReplay before version 1.27.0 allows an authenticated user to read any ClickHouse table via SQL injection in the session search and analytics API. The attacker can perform blind boolean and time-based data exfiltration and disrupt session search for all users.

A vulnerability in OpenReplay allows an authenticated low-privilege user to read the first 15 seconds of session replay data from another tenant. The issue stems from missing validation that the session belongs to the project when generating presigned download URLs.

In OpenReplay versions 1.27.0 and earlier, three mutation functions (notes.delete, dashboards.update_widget, dashboards.remove_widget) did not check resource ownership, allowing any authenticated user to delete other users' private session notes and modify widgets on their private dashboards.