PT-2026-44457 · Unknown · Openreplay

Larlarua · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-45296

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenReplay versions prior to 1.26.0

Description OpenReplay is a self-hosted session replay suite. The Python API contains several 'app apikey' routes that trust a caller-provided projectKey after verifying only the validity of the API key and the existence of the target projectKey. The authorization flow fails to verify that the authenticated API key and the requested project belong to the same tenant. Since the public tracker design exposes the projectKey to browser-side code, an attacker with a valid API key for their own tenant can use another tenant's public projectKey to enumerate victim user sessions and retrieve sensitive session event data across tenant boundaries.

Recommendations Update to version 1.26.0.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-45296

Affected Products

Openreplay

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-45296 · Security Note
• https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5 · Note
• https://twitter.com/VulmonFeeds/status/2060120493328355561 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060093068380938452 · Twitter Post
• https://twitter.com/CVEnew/status/2060091986732888523 · Twitter Post