Skip to content
OpenAdvisories

Vendor

openreplay

8 known vulnerabilities.

Products

openreplay 8
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-57230

    OpenReplay: Authenticated ClickHouse SQL injection via session search

    OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took…

    openreplay openreplay
  • Medium 5.3
    CVE-2026-45297

    Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch

    OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_proj…

    openreplay openreplay
  • Medium 6.9
    CVE-2026-28443

    OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

    OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.

    openreplay openreplay
  • Medium 6.5
    CVE-2023-48226

    OpenReplay HTML Injection vulnerability

    OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors ca…

    openreplay openreplay