OpenReplay up to 1.27.0 Dashboard/Note Mutation authentication replay

Summaryinfo

A vulnerability was found in OpenReplay up to 1.27.0. It has been classified as critical. Affected by this vulnerability is the function notes.delete/dashboards.update_widget/dashboards.remove_widget of the component Dashboard/Note Mutation. This manipulation causes authentication replay. This vulnerability is handled as CVE-2026-55880. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in OpenReplay up to 1.27.0. Affected by this vulnerability is the function notes.delete/dashboards.update_widget/dashboards.remove_widget of the component Dashboard/Note Mutation. The manipulation with an unknown input leads to a authentication replay vulnerability. The CWE definition for the vulnerability is CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-55880 since 06/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/10/2026). MITRE ATT&CK project uses the attack technique T1040 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• OpenReplay

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27.0

Website

• Product: https://github.com/openreplay/openreplay/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion