CVE-2026-45296

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.

• CWE-284

• https://github.com/openreplay/openreplay/security/advisories/GHSA-8wmc-vpmf-cjf5

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45290Cloudburst Network provides network components used within C…7.5
• CVE-2026-45291Cloudburst Network provides network components used within C…7.5
• CVE-2026-45292opentelemetry-java is the Java implementation of the OpenTel…5.3
• CVE-2026-45293WordPress Coding Standards is a set of PHP_CodeSniffer rules…8.6
• CVE-2026-45294FreeScout is a free help desk and shared inbox built with PH…5.3
• CVE-2026-45295FreeScout is a free help desk and shared inbox built with PH…6.5
• CVE-2026-45297OpenReplay is a self-hosted session replay suite. Prior to 1…5.3
• CVE-2026-45298Dozzle is a realtime log viewer for docker containers. Prior…8.6
• CVE-2026-45299Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-4530A security flaw has been discovered in apconw Aix-DB up to 1…5.3
• CVE-2026-45300The AsyncHttpClient (AHC) library allows Java applications t…7.4
• CVE-2026-45301Open WebUI is a self-hosted artificial intelligence platform…8.1