Executive brief
OpenReplay, a self-hosted session replay suite used to monitor user behavior on websites, is vulnerable to a security flaw that allows unauthorized attackers to take over administrative accounts. By submitting malicious data through a website's public tracking key, an attacker can inject scripts that execute when a legitimate staff member views the data in the OpenReplay dashboard. This can result in the theft of login credentials (JWT tokens), giving the attacker full access to view recorded sessions, change project settings, or manage other users.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in OpenReplay versions 1.24.0 through 1.24.x. The tracking SDK accepts custom event names and page URLs from any visitor using a public project key and stores them in ClickHouse without proper output encoding. When an authenticated user views these events in the dashboard, the 'TextEllipsis' component and event-details modal render the raw values, executing any injected scripts. Because the dashboard lacks a Content Security Policy (CSP) and stores session JWTs in localStorage, an attacker can programmatically exfiltrate the token to take over the victim's account. The issue is resolved in version 1.25.0 by centralizing output encoding for event read paths.
Affected products
- OpenReplay OpenReplay >= 1.24.0, < 1.25.0
Timeline
- 2026-01-30: patched: Version 1.25.0 released
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD