CVE-2026-55879 Details
Description
OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.
A stored cross-site scripting vulnerability has been identified in OpenReplay versions 1.24.0 prior to 1.25.0. The issue arises in the OpenReplay tracking SDK, which accepts custom event names and page URLs from any visitor using a public project key. This data is stored in ClickHouse without proper output encoding and later rendered in the authenticated dashboard. The vulnerability allows an unauthenticated attacker to inject scripts that execute in the dashboard context, read the session JWT from localStorage, and take over a dashboard account.
Users can upgrade to OpenReplay version 1.25.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openreplay/openreplay/commit/ec41f4425a99c478a4418adbd2f094ab6a8b0daf | [email protected] | Source CodeVendor |
| https://github.com/openreplay/openreplay/releases/tag/v1.25.0 | [email protected] | Release NotesVendor |
| https://github.com/openreplay/openreplay/security/advisories/GHSA-3mfc-7hf4-jfxh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenReplay | >= 1.24.0, < 1.25.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |