Skip to content
OpenAdvisories

Vendor

openreplay

8 known vulnerabilities.

Products

openreplay 8
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-55881

    OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint

    OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only th…

    openreplay openreplay
  • High 7.1
    CVE-2026-55880

    OpenReplay: Cross-user IDOR in notes and dashboard widgets

    OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and projec…

    openreplay openreplay
  • High 7.7
    CVE-2026-45296

    OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding

    OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. …

    openreplay openreplay