Search
Find a vulnerability
Search criteria
16 vulnerabilities found for openreplay by openreplay
CVE-2026-57230 (GCVE-0-2026-57230)
Vulnerability from nvd – Published: 2026-07-10 20:47 – Updated: 2026-07-10 20:47
VLAI
EPSS
VEX
Title
OpenReplay: Authenticated ClickHouse SQL injection via session search
Summary
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.
Severity
5.4 (Medium)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://github.com/openreplay/openreplay/pull/4715 | x_refsource_MISC |
| https://github.com/openreplay/openreplay/commit/a… | x_refsource_MISC |
| https://github.com/openreplay/openreplay/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.27.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project\u0027s session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:47:31.404Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-vxf8-j7jx-p65x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-vxf8-j7jx-p65x"
},
{
"name": "https://github.com/openreplay/openreplay/pull/4715",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/pull/4715"
},
{
"name": "https://github.com/openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16"
},
{
"name": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0"
}
],
"source": {
"advisory": "GHSA-vxf8-j7jx-p65x",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Authenticated ClickHouse SQL injection via session search"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57230",
"datePublished": "2026-07-10T20:47:31.404Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-07-10T20:47:31.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55881 (GCVE-0-2026-55881)
Vulnerability from nvd – Published: 2026-07-10 20:44 – Updated: 2026-07-10 20:44
VLAI
EPSS
VEX
Title
OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint
Summary
OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester's tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant's first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://github.com/openreplay/openreplay/pull/4692 | x_refsource_MISC |
| https://github.com/openreplay/openreplay/commit/d… | x_refsource_MISC |
| https://github.com/openreplay/openreplay/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
>= 1.22.0, < 1.27.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.22.0, \u003c 1.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session\u0027s DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester\u0027s tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant\u0027s first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:44:15.897Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-w2x5-m7w5-479h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-w2x5-m7w5-479h"
},
{
"name": "https://github.com/openreplay/openreplay/pull/4692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/pull/4692"
},
{
"name": "https://github.com/openreplay/openreplay/commit/ddd09117f644a309c7b040cda0a11ff9433e9e49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/commit/ddd09117f644a309c7b040cda0a11ff9433e9e49"
},
{
"name": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0"
}
],
"source": {
"advisory": "GHSA-w2x5-m7w5-479h",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55881",
"datePublished": "2026-07-10T20:44:15.897Z",
"dateReserved": "2026-06-17T16:59:42.759Z",
"dateUpdated": "2026-07-10T20:44:15.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55880 (GCVE-0-2026-55880)
Vulnerability from nvd – Published: 2026-07-10 20:42 – Updated: 2026-07-10 20:42
VLAI
EPSS
VEX
Title
OpenReplay: Cross-user IDOR in notes and dashboard widgets
Summary
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.
Severity
7.1 (High)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
<= 1.27.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user\u0027s private session notes and remove or rewrite widgets on another user\u0027s private dashboards."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:42:15.563Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9"
}
],
"source": {
"advisory": "GHSA-9xfv-p2fx-vmx9",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Cross-user IDOR in notes and dashboard widgets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55880",
"datePublished": "2026-07-10T20:42:15.563Z",
"dateReserved": "2026-06-17T16:59:42.759Z",
"dateUpdated": "2026-07-10T20:42:15.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55879 (GCVE-0-2026-55879)
Vulnerability from nvd – Published: 2026-07-10 20:39 – Updated: 2026-07-10 20:39
VLAI
EPSS
VEX
Title
OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover
Summary
OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.
Severity
9.3 (Critical)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://github.com/openreplay/openreplay/commit/e… | x_refsource_MISC |
| https://github.com/openreplay/openreplay/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
>= 1.24.0, < 1.25.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.24.0, \u003c 1.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:39:44.493Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-3mfc-7hf4-jfxh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-3mfc-7hf4-jfxh"
},
{
"name": "https://github.com/openreplay/openreplay/commit/ec41f4425a99c478a4418adbd2f094ab6a8b0daf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/commit/ec41f4425a99c478a4418adbd2f094ab6a8b0daf"
},
{
"name": "https://github.com/openreplay/openreplay/releases/tag/v1.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/releases/tag/v1.25.0"
}
],
"source": {
"advisory": "GHSA-3mfc-7hf4-jfxh",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55879",
"datePublished": "2026-07-10T20:39:44.493Z",
"dateReserved": "2026-06-17T16:59:42.759Z",
"dateUpdated": "2026-07-10T20:39:44.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45297 (GCVE-0-2026-45297)
Vulnerability from nvd – Published: 2026-05-28 16:50 – Updated: 2026-05-29 15:31
VLAI
EPSS
VEX
Title
Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch
Summary
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.26.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T15:31:04.896764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T15:31:12.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == \"projectId\" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({\"errors\":[\"tenants already registered\"]} on second signup) so there\u0027s no cross-tenant impact This vulnerability is fixed in 1.26.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T16:50:38.672Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx"
}
],
"source": {
"advisory": "GHSA-5m23-rcj4-cgjx",
"discovery": "UNKNOWN"
},
"title": "Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45297",
"datePublished": "2026-05-28T16:50:38.672Z",
"dateReserved": "2026-05-11T20:14:43.201Z",
"dateUpdated": "2026-05-29T15:31:12.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45296 (GCVE-0-2026-45296)
Vulnerability from nvd – Published: 2026-05-28 16:51 – Updated: 2026-05-30 02:00
VLAI
EPSS
VEX
Title
OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding
Summary
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.26.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-30T02:00:33.552907Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-30T02:00:43.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay\u0027s Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant\u0027s project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T16:51:47.094Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5"
}
],
"source": {
"advisory": "GHSA-8wmc-vpmf-cjf5",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45296",
"datePublished": "2026-05-28T16:51:47.094Z",
"dateReserved": "2026-05-11T20:14:43.201Z",
"dateUpdated": "2026-05-30T02:00:43.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28443 (GCVE-0-2026-28443)
Vulnerability from nvd – Published: 2026-03-05 20:53 – Updated: 2026-03-06 16:08
VLAI
EPSS
VEX
Title
OpenReplay: SQL injection in cards/search via unvalidated sort field parameter
Summary
OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28443",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T16:08:03.455688Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T16:08:11.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T20:53:17.967Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5"
}
],
"source": {
"advisory": "GHSA-q6gf-3qg3-pww5",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: SQL injection in cards/search via unvalidated sort field parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-28443",
"datePublished": "2026-03-05T20:53:17.967Z",
"dateReserved": "2026-02-27T15:54:05.140Z",
"dateUpdated": "2026-03-06T16:08:11.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-48226 (GCVE-0-2023-48226)
Vulnerability from nvd – Published: 2023-11-21 19:37 – Updated: 2024-08-02 21:23
VLAI
EPSS
VEX
Title
OpenReplay HTML Injection vulnerability
Summary
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.
Severity
6.5 (Medium)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://bugcrowd.com/vulnerability-rating-taxonomy | x_refsource_MISC |
| https://capec.mitre.org/data/definitions/242.html | x_refsource_MISC |
| https://cwe.mitre.org/data/definitions/20.html | x_refsource_MISC |
| https://github.com/openreplay/openreplay/blob/mai… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
= 1.14.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:23:39.200Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4"
},
{
"name": "https://bugcrowd.com/vulnerability-rating-taxonomy",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugcrowd.com/vulnerability-rating-taxonomy"
},
{
"name": "https://capec.mitre.org/data/definitions/242.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://capec.mitre.org/data/definitions/242.html"
},
{
"name": "https://cwe.mitre.org/data/definitions/20.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"name": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "= 1.14.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-21T19:37:57.103Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4"
},
{
"name": "https://bugcrowd.com/vulnerability-rating-taxonomy",
"tags": [
"x_refsource_MISC"
],
"url": "https://bugcrowd.com/vulnerability-rating-taxonomy"
},
{
"name": "https://capec.mitre.org/data/definitions/242.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://capec.mitre.org/data/definitions/242.html"
},
{
"name": "https://cwe.mitre.org/data/definitions/20.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"name": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421"
}
],
"source": {
"advisory": "GHSA-xpfv-454c-3fj4",
"discovery": "UNKNOWN"
},
"title": "OpenReplay HTML Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-48226",
"datePublished": "2023-11-21T19:37:57.103Z",
"dateReserved": "2023-11-13T13:25:18.480Z",
"dateUpdated": "2024-08-02T21:23:39.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-57230 (GCVE-0-2026-57230)
Vulnerability from cvelistv5 – Published: 2026-07-10 20:47 – Updated: 2026-07-10 20:47
VLAI
EPSS
VEX
Title
OpenReplay: Authenticated ClickHouse SQL injection via session search
Summary
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.
Severity
5.4 (Medium)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://github.com/openreplay/openreplay/pull/4715 | x_refsource_MISC |
| https://github.com/openreplay/openreplay/commit/a… | x_refsource_MISC |
| https://github.com/openreplay/openreplay/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.27.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project\u0027s session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:47:31.404Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-vxf8-j7jx-p65x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-vxf8-j7jx-p65x"
},
{
"name": "https://github.com/openreplay/openreplay/pull/4715",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/pull/4715"
},
{
"name": "https://github.com/openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16"
},
{
"name": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0"
}
],
"source": {
"advisory": "GHSA-vxf8-j7jx-p65x",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Authenticated ClickHouse SQL injection via session search"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57230",
"datePublished": "2026-07-10T20:47:31.404Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-07-10T20:47:31.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55881 (GCVE-0-2026-55881)
Vulnerability from cvelistv5 – Published: 2026-07-10 20:44 – Updated: 2026-07-10 20:44
VLAI
EPSS
VEX
Title
OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint
Summary
OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester's tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant's first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://github.com/openreplay/openreplay/pull/4692 | x_refsource_MISC |
| https://github.com/openreplay/openreplay/commit/d… | x_refsource_MISC |
| https://github.com/openreplay/openreplay/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
>= 1.22.0, < 1.27.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.22.0, \u003c 1.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session\u0027s DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester\u0027s tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant\u0027s first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:44:15.897Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-w2x5-m7w5-479h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-w2x5-m7w5-479h"
},
{
"name": "https://github.com/openreplay/openreplay/pull/4692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/pull/4692"
},
{
"name": "https://github.com/openreplay/openreplay/commit/ddd09117f644a309c7b040cda0a11ff9433e9e49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/commit/ddd09117f644a309c7b040cda0a11ff9433e9e49"
},
{
"name": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/releases/tag/v1.27.0"
}
],
"source": {
"advisory": "GHSA-w2x5-m7w5-479h",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55881",
"datePublished": "2026-07-10T20:44:15.897Z",
"dateReserved": "2026-06-17T16:59:42.759Z",
"dateUpdated": "2026-07-10T20:44:15.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55880 (GCVE-0-2026-55880)
Vulnerability from cvelistv5 – Published: 2026-07-10 20:42 – Updated: 2026-07-10 20:42
VLAI
EPSS
VEX
Title
OpenReplay: Cross-user IDOR in notes and dashboard widgets
Summary
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.
Severity
7.1 (High)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
<= 1.27.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user\u0027s private session notes and remove or rewrite widgets on another user\u0027s private dashboards."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:42:15.563Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-9xfv-p2fx-vmx9"
}
],
"source": {
"advisory": "GHSA-9xfv-p2fx-vmx9",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Cross-user IDOR in notes and dashboard widgets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55880",
"datePublished": "2026-07-10T20:42:15.563Z",
"dateReserved": "2026-06-17T16:59:42.759Z",
"dateUpdated": "2026-07-10T20:42:15.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55879 (GCVE-0-2026-55879)
Vulnerability from cvelistv5 – Published: 2026-07-10 20:39 – Updated: 2026-07-10 20:39
VLAI
EPSS
VEX
Title
OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover
Summary
OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0.
Severity
9.3 (Critical)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://github.com/openreplay/openreplay/commit/e… | x_refsource_MISC |
| https://github.com/openreplay/openreplay/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
>= 1.24.0, < 1.25.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.24.0, \u003c 1.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store script that executes in the dashboard origin, reads the session JWT from localStorage, and takes over a dashboard account. This issue is fixed in version 1.25.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:39:44.493Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-3mfc-7hf4-jfxh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-3mfc-7hf4-jfxh"
},
{
"name": "https://github.com/openreplay/openreplay/commit/ec41f4425a99c478a4418adbd2f094ab6a8b0daf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/commit/ec41f4425a99c478a4418adbd2f094ab6a8b0daf"
},
{
"name": "https://github.com/openreplay/openreplay/releases/tag/v1.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/releases/tag/v1.25.0"
}
],
"source": {
"advisory": "GHSA-3mfc-7hf4-jfxh",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55879",
"datePublished": "2026-07-10T20:39:44.493Z",
"dateReserved": "2026-06-17T16:59:42.759Z",
"dateUpdated": "2026-07-10T20:39:44.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45296 (GCVE-0-2026-45296)
Vulnerability from cvelistv5 – Published: 2026-05-28 16:51 – Updated: 2026-05-30 02:00
VLAI
EPSS
VEX
Title
OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding
Summary
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.26.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-30T02:00:33.552907Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-30T02:00:43.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay\u0027s Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant\u0027s project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T16:51:47.094Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5"
}
],
"source": {
"advisory": "GHSA-8wmc-vpmf-cjf5",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45296",
"datePublished": "2026-05-28T16:51:47.094Z",
"dateReserved": "2026-05-11T20:14:43.201Z",
"dateUpdated": "2026-05-30T02:00:43.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45297 (GCVE-0-2026-45297)
Vulnerability from cvelistv5 – Published: 2026-05-28 16:50 – Updated: 2026-05-29 15:31
VLAI
EPSS
VEX
Title
Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch
Summary
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == "projectId" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({"errors":["tenants already registered"]} on second signup) so there's no cross-tenant impact This vulnerability is fixed in 1.26.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.26.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-29T15:31:04.896764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-29T15:31:12.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ (OSS api/auth/auth_project.py:14-38 and EE ee/api/auth/auth_project.py:14-46) only runs projects.is_authorized(project_id, tenant_id, user_id) + projects.get_project(tenant_id, project_id) when self.project_identifier == \"projectId\" (camelCase). For EE multi-tenant, feature-flag queries only filter on project_id, never tenant_id. Any authenticated user in tenant A can read/update/delete feature-flag rows belonging to tenant B by iterating the sequential integer project_id + feature_flag_id. OSS is single-tenant by design ({\"errors\":[\"tenants already registered\"]} on second signup) so there\u0027s no cross-tenant impact This vulnerability is fixed in 1.26.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T16:50:38.672Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-5m23-rcj4-cgjx"
}
],
"source": {
"advisory": "GHSA-5m23-rcj4-cgjx",
"discovery": "UNKNOWN"
},
"title": "Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45297",
"datePublished": "2026-05-28T16:50:38.672Z",
"dateReserved": "2026-05-11T20:14:43.201Z",
"dateUpdated": "2026-05-29T15:31:12.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28443 (GCVE-0-2026-28443)
Vulnerability from cvelistv5 – Published: 2026-03-05 20:53 – Updated: 2026-03-06 16:08
VLAI
EPSS
VEX
Title
OpenReplay: SQL injection in cards/search via unvalidated sort field parameter
Summary
OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
< 1.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28443",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T16:08:03.455688Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T16:08:11.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "\u003c 1.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T20:53:17.967Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5"
}
],
"source": {
"advisory": "GHSA-q6gf-3qg3-pww5",
"discovery": "UNKNOWN"
},
"title": "OpenReplay: SQL injection in cards/search via unvalidated sort field parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-28443",
"datePublished": "2026-03-05T20:53:17.967Z",
"dateReserved": "2026-02-27T15:54:05.140Z",
"dateUpdated": "2026-03-06T16:08:11.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-48226 (GCVE-0-2023-48226)
Vulnerability from cvelistv5 – Published: 2023-11-21 19:37 – Updated: 2024-08-02 21:23
VLAI
EPSS
VEX
Title
OpenReplay HTML Injection vulnerability
Summary
OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available.
Severity
6.5 (Medium)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/openreplay/openreplay/security… | x_refsource_CONFIRM |
| https://bugcrowd.com/vulnerability-rating-taxonomy | x_refsource_MISC |
| https://capec.mitre.org/data/definitions/242.html | x_refsource_MISC |
| https://cwe.mitre.org/data/definitions/20.html | x_refsource_MISC |
| https://github.com/openreplay/openreplay/blob/mai… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openreplay | openreplay |
Affected:
= 1.14.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:23:39.200Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4"
},
{
"name": "https://bugcrowd.com/vulnerability-rating-taxonomy",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugcrowd.com/vulnerability-rating-taxonomy"
},
{
"name": "https://capec.mitre.org/data/definitions/242.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://capec.mitre.org/data/definitions/242.html"
},
{
"name": "https://cwe.mitre.org/data/definitions/20.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"name": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "openreplay",
"vendor": "openreplay",
"versions": [
{
"status": "affected",
"version": "= 1.14.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like validation is correct), a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for example. Email is really send from OpenReplay, but bad actors can add there HTML code injected (content spoofing). Please notice that during Registration steps for FullName looks like is validated correct - can not type there, but using this kind of bypass/workaround - bad actors can achieve own goal. As of time of publication, no known fixes or workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-21T19:37:57.103Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openreplay/openreplay/security/advisories/GHSA-xpfv-454c-3fj4"
},
{
"name": "https://bugcrowd.com/vulnerability-rating-taxonomy",
"tags": [
"x_refsource_MISC"
],
"url": "https://bugcrowd.com/vulnerability-rating-taxonomy"
},
{
"name": "https://capec.mitre.org/data/definitions/242.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://capec.mitre.org/data/definitions/242.html"
},
{
"name": "https://cwe.mitre.org/data/definitions/20.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"name": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openreplay/openreplay/blob/main/api/chalicelib/utils/html/invitation.html#L421"
}
],
"source": {
"advisory": "GHSA-xpfv-454c-3fj4",
"discovery": "UNKNOWN"
},
"title": "OpenReplay HTML Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-48226",
"datePublished": "2023-11-21T19:37:57.103Z",
"dateReserved": "2023-11-13T13:25:18.480Z",
"dateUpdated": "2024-08-02T21:23:39.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}