Is CVE-2026-55879 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55879 being exploited in the wild.

How severe is CVE-2026-55879?

Critical severity, with a CVSS score of 9.3, published 10 July 2026.

Which products and versions are affected?

OpenReplay >= 1.24.0, < 1.25.0.

Is there a fix for CVE-2026-55879?

A patch was published on 2026-01-30: Version 1.25.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55879 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55879?

Check whether you run OpenReplay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55879: OpenReplay stored XSS in tracking SDK leads to account takeover

Q: Is there a fix for CVE-2026-55879?

A patch was published on 2026-01-30: Version 1.25.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55879 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55879?

Check whether you run OpenReplay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55879 · Severity: critical · CVSS 9.3 · Published 2026-07-10

OpenReplay, a self-hosted session replay suite used to monitor user behavior on websites, is vulnerable to a security flaw that allows unauthorized attackers to take over administrative accounts. By submitting malicious data through a website's public tracking key, an attacker can inject scripts that execute when a legitimate staff member views the data in the OpenReplay dashboard. This can result in the theft of login credentials (JWT tokens), giving the attacker full access to view recorded sessions, change project settings, or manage other users.

Technologies: OpenReplay. Vendors: OpenReplay.

Quick answers

Is CVE-2026-55879 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55879 being exploited in the wild.
How severe is CVE-2026-55879?: Critical severity, with a CVSS score of 9.3, published 10 July 2026.
Which products and versions are affected?: OpenReplay >= 1.24.0, < 1.25.0.
Is there a fix for CVE-2026-55879?: A patch was published on 2026-01-30: Version 1.25.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55879 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55879?: Check whether you run OpenReplay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in OpenReplay versions 1.24.0 through 1.24.x. The tracking SDK accepts custom event names and page URLs from any visitor using a public project key and stores them in ClickHouse without proper output encoding. When an authenticated user views these events in the dashboard, the 'TextEllipsis' component and event-details modal render the raw values, executing any injected scripts. Because the dashboard lacks a Content Security Policy (CSP) and stores session JWTs in localStorage, an attacker can programmatically exfiltrate the token to take over the victim's account. The issue is resolved in version 1.25.0 by centralizing output encoding for event read paths.

Affected products

OpenReplay OpenReplay >= 1.24.0, < 1.25.0

Timeline

2026-01-30: patched: Version 1.25.0 released
2026-06-16: advisory: GitHub Security Advisory published
2026-07-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.