CVE-2026-45296

Vulnerability

OpenReplay prior to version 1.26.0 contains a missing tenant-binding check in its Python API. Several app_apikey routes trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. The vulnerable code is in api/auth/auth_project.py where ProjectAuthorizer uses projects.get_by_project_key(project_key=value) globally instead of scoping the lookup by the API key owner's tenant ID [1]. Versions prior to 1.26.0 are affected.

Exploitation

An attacker must have a valid API key for their own tenant. Because the public tracker design exposes projectKey to browser-side code, the attacker can obtain the target tenant's projectKey (e.g., from a victim's client-side code). The attacker then submits that projectKey to a vulnerable app_apikey route along with their own valid API key. The API key authenticates the attacker, but the projectKey lookup is not scoped to the attacker's tenant, so the server returns data from the victim's project [1]. No special network position is required beyond normal API access.

Impact

A successful exploit allows the attacker to enumerate victim user sessions and retrieve sensitive session event data across the tenant boundary. This constitutes unauthorized information disclosure of private session replay data belonging to another tenant's users [1]. The compromise is limited to read access via the vulnerable routes; the attacker does not gain administrative privileges or ability to modify data.

Mitigation

OpenReplay fixed the vulnerability in version 1.26.0 by ensuring that projectKey lookups are scoped to the authenticated API key's tenant [1]. Users should upgrade to 1.26.0 or later. There are no publicly known workarounds for unpatched versions. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication date.