Read the docs
TI-2023-26090 Aliases CVE-2023-48226

OpenReplay HTML Injection vulnerability

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.

Why it matters now

EPSS 0.00779 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
openreplayopenreplay= 1.14.0—No fix listedCNA
  • openreplay Vendoropenreplay Affected = 1.14.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openreplay:openreplay:*:*:*:*:*:*:*:*before 1.15.0Vulnerableopenreplay
  • cpe:2.3:a:openreplay:openreplay:*:*:*:*:*:*:*:* Versions before 1.15.0 Vulnerable ·openreplay

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48226

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-22713 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences