CVE-2026-55879

Name of the Vulnerable Software and Affected Versions OpenReplay versions 1.24.0 through 1.24.x

Description The tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key. These values are stored in ClickHouse without output encoding and subsequently rendered in the authenticated dashboard via TextEllipsis and the event-details modal. This allows an unauthenticated attacker to store a script that executes within the dashboard origin, enabling the theft of the session JWT (JSON Web Token) from localStorage and the subsequent takeover of a dashboard account.

Recommendations Update to version 1.25.0.