CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter
Attackers can execute arbitrary SQL commands via the sort field parameter in the cards search endpoint, potentially accessing or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28443?
CVE-2026-28443 is a medium-severity SQL injection vulnerability in openreplay, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-28443?
It affects 1 product.
Products include Openreplay Openreplay.
How do I fix CVE-2026-28443?
No fix has been published for CVE-2026-28443 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-28443 being exploited?
There is no known exploitation of CVE-2026-28443 in the wild and no public exploit code.
Other vulnerabilities in openreplay
Sources
Also known as GHSA-q6gf-3qg3-pww5.