Executive brief
OpenReplay is a self-hosted session replay suite used by businesses to monitor and analyze how users interact with their websites. A security flaw in the software's API allows an authorized user from one organization to access the private session data and user activity of a completely different organization. This could lead to the exposure of sensitive customer behavior and business data, potentially damaging a company's reputation and violating privacy regulations.
Technical details
An improper access control vulnerability exists in OpenReplay's Python API due to a missing tenant-binding check in the 'app_apikey' routes. While the APIKeyAuth component validates that an API key is valid, the ProjectAuthorizer resolves 'projectKey' identifiers globally without ensuring the project belongs to the authenticated user's tenant. Because projectKeys are exposed in client-side browser code by design, an attacker with low-privileged credentials (any valid API key) can supply a victim's projectKey to enumerate user sessions and retrieve sensitive session event data. This bypasses tenant isolation in multi-tenant deployments. The issue is fixed in version 1.26.0.
Affected products
- OpenReplay OpenReplay < 1.26.0
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: NVD publication date