CVE-2026-45296Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5

Weakness type (CWE)

CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

CVE@CVEnew137d
Disclosure
CVE-2026-45296 OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey a… https://www.cve.org/CVERecord?id=CVE-2026-45296
Post summary
The brief CVE record indicates a flaw in OpenReplay’s Python API that trusts user‑supplied project keys, but the excerpt provides only a high‑level disclosure without proof of exploitation, patch details, or technical depth.
00010284
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-45296 Authorization Bypass in OpenReplay Prior to 1.26.0 Enables Cross-Tenant Data Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45296
Post summary
The CVE-2026-45296 vulnerability is an authorization bypass in OpenReplay versions before 1.26.0, allowing cross‑tenant data access; updating to 1.26.0 or newer resolves the issue.
0000042
4.0K followersView on X
Infoflowcloud@infoflowcloud137d
Disclosure
🚨*CVE* CVE-2026-45296 OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey a… https://www.cve.org/CVERecord?id=CVE-2026-45296 ----- Traducción: CVE-2026-45296 Ope… http://infoflow.cloud`
Post summary
The message announces CVE-2026-45296 affecting OpenReplay, highlighting an authentication flaw in its Python API prior to version 1.26.0.
0000036
79 followersView on X

Explore more

Back to dashboard