CVE-2026-45296 - OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding

Back Back to CVE browser

HIGH

OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding

Published May 28, 2026

7.7

HIGH

CVSS 3.1

EPSS 0.37%

Description

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.

Affected products

Vendor Openreplay Product Openreplay Default
n/a
- Version
  < 1.26.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Openreplay

n/a

Version	Status	Constraints
< 1.26.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32971
Advisory
https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32971		Advisory
https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5		x_refsource_CONFIRM