Executive brief
OpenReplay, a self-hosted tool for recording and replaying user sessions on websites, contains a security flaw that could allow unauthorized users to view recordings from other organizations. An authenticated user could exploit this to obtain temporary download links for the first 15 seconds of any session recording, potentially exposing sensitive user interactions or private data. This could lead to data privacy breaches and reputational damage for companies hosting multiple clients on the same OpenReplay instance.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the getFirstMob endpoint of OpenReplay. The root cause is a missing ownership validation: while the system verifies that a requested project ID belongs to the user's tenant, it fails to verify that the requested session ID actually belongs to that project. By providing a valid session ID from a different tenant in the path parameter, an authenticated attacker can obtain presigned S3 URLs for the first 15 seconds of DOM-replay data (dom.mobs and dom.mobe). This affects multi-tenant deployments where users are isolated by project. The vulnerability is resolved in version 1.27.0 by adding an explicit sessions.IsExists(projID, sessID) check in the backend handler.
Affected products
- OpenReplay OpenReplay >= 1.22.0, < 1.27.0
Timeline
- 2026-05-05: patched: Version 1.27.0 released
- 2026-06-11: other: Fix commit merged into main branch
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD