Read the docs
TI-2026-40332 Aliases CVE-2026-55879

OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover

Priority MEDIUM 43CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed openreplay (openreplay): 1.25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openreplayopenreplay1.24.0 to before 1.25.01.25.0Patch availableCNA
  • openreplay Vendoropenreplay Affected 1.24.0 to before 1.25.0 Fixed in 1.25.0 Patch available CNA

Remediation

  • Fix · CNA openreplay (openreplay) Fixed in 1.25.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55879

References

Other 3

  • TI-2026-22713 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-33096 OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding CVSS 3.1HIGH 7.7
  • TI-2026-40334 OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint CVSS 4.0HIGH 7.1
  • TI-2026-40333 OpenReplay: Cross-user IDOR in notes and dashboard widgets CVSS 3.1HIGH 7.1
  • TI-2023-26090 OpenReplay HTML Injection vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2026-33097 Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch CVSS 4.0MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences