What is the CVSS score of CVE-2026-55879?

CVE-2026-55879 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of OpenReplay are affected by CVE-2026-55879?

OpenReplay versions 1.24.0 through 1.24.x contain a stored cross-site scripting vulnerability that allows attackers with a public project key to inject malicious code into session records without…. A patch is available.

How to fix or mitigate CVE-2026-55879?

Within 24 hours: Inventory all OpenReplay deployments and identify instances running versions 1.24.0 through 1.24.x; restrict dashboard access to essential personnel only. Within 7 days: Upgrade all affected instances to OpenReplay version 1.25.0 or later. Within 30 days: Rotate all OpenReplay-related API credentials and session tokens; conduct comprehensive audit of dashboard access logs for indicators of compromise; validate successful patch deployment across all systems.

OpenReplay CVE-2026-55879

EUVD-2026-43030 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 GitHub_M

XSS Openreplay

9.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Unauthenticated injection via public project key (PR:N) over the network, but a dashboard operator must view the session (UI:R); XSS crosses from SDK into dashboard origin (S:C) enabling JWT theft and account takeover (C:H/I:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 22:02 EUVD

Analysis Generated

Jul 10, 2026 - 21:35 vuln.today

DescriptionCVE.org

OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.

AnalysisAI

Stored cross-site scripting in OpenReplay 1.24.0 through versions before 1.25.0 allows an unauthenticated attacker holding only a public project key to inject script via custom event names and captured page URLs, which the tracking SDK stores in ClickHouse without output encoding and the authenticated dashboard later renders through TextEllipsis and the event-details modal. When a logged-in operator views the poisoned session, the payload executes in the dashboard origin, reads the session JWT from localStorage, and enables full dashboard account takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS base score is 9.3 and a vendor fix exists in 1.25.0.

Technical ContextAI

OpenReplay is a self-hosted session-replay and product-analytics suite whose front-end JavaScript tracking SDK ingests telemetry (custom event names, captured page URLs) from any site visitor authenticated only by a public, client-side project key. That untrusted data is persisted into ClickHouse, OpenReplay's columnar analytics store, and is later rendered back into the authenticated operator dashboard. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the values are stored verbatim and reflected into the DOM through the TextEllipsis component and the event-details modal without contextual output encoding, so attacker-controlled markup is interpreted as live script. Because the SDK trusts the public project key by design, there is no authentication boundary between the attacker's input and the persistence layer. The single affected CPE is cpe:2.3:a:openreplay:openreplay:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 1.25.0 - upgrade all OpenReplay components to v1.25.0 (release https://github.com/openreplay/openreplay/releases/tag/v1.25.0), which introduces output encoding in the affected rendering paths; the corresponding fix commit is ec41f4425a99c478a4418adbd2f094ab6a8b0daf and the advisory is GHSA-3mfc-7hf4-jfxh. If immediate upgrade is not possible, rotate any potentially exposed public project keys and issue new ones so previously harvested keys cannot be reused to inject fresh payloads, and treat all pre-upgrade stored events and page URLs as tainted (purge or re-encode historical ClickHouse event data before viewing it in the dashboard), accepting the trade-off of losing that historical session detail. As additional hardening, deploy a strict Content-Security-Policy on the dashboard origin to block inline script execution and consider moving the session JWT out of localStorage into an HttpOnly cookie to break the token-theft step, noting these are defense-in-depth measures that do not remove the underlying flaw and that a restrictive CSP may require dashboard testing to avoid breaking legitimate scripts.