OpenReplay, a self‑hosted session replay suite, suffered a stored cross‑site scripting flaw that allowed any visitor using a public project key to send custom event names or page URLs containing malicious script. These values were stored in ClickHouse without encoding and later rendered in the authenticated dashboard through TextEllipsis and the event‑details modal. The unprotected script runs in the dashboard origin, can read the session JWT from localStorage, and hijacks the dashboard account.

The vulnerability affects OpenReplay deployments running versions 1.24.0 up to, but not including, 1.25.0. Any installation that uses the public project key for the session‑tracking SDK and accepts custom event names or URLs is susceptible.

The CVSS score of 9.3 indicates critical severity. Exploitation requires only a crafted request to the public SDK endpoint; authentication is not needed. Once the malicious data is stored, the attack becomes effective when an authenticated user views the event details and the injected script executes. The EPSS score of < 1% suggests a very low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the potential for account takeover warrants immediate remediation.