CVE-2026-45296

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45296
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45296.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45296
Aliases
  • GHSA-8wmc-vpmf-cjf5
Published
2026-05-28T16:51:47.094Z
Modified
2026-07-15T01:49:21.711748512Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding
Details

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. The authorization flow does not verify that the authenticated API key and the requested project belong to the same tenant. Because the public tracker design exposes projectKey to browser-side code, an attacker who owns any valid API key for their own tenant can target another tenant's project by reusing that public projectKey. The vulnerable routes allow the attacker to enumerate victim user sessions and then retrieve sensitive session event data across the tenant boundary. This vulnerability is fixed in 1.26.0.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45296.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/openreplay/openreplay

Affected ranges

Type
GIT
Repo
https://github.com/openreplay/openreplay
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f450d5dbc689f15ea803ee864b5c598f3f013c6d
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.26.0"
        }
    ]
}

Affected versions

0.*
0.6.17
Other
argo
or-argo-test
pre-v1.*
pre-v1.19.0
pre-v1.20.0
pre-v1.21.0
pre-v1.22.0
pre-v1.24.0
pre-v1.25.0
pre-v1.26.0
pre_v1.*
pre_v1.18.0
v.*
v.1.14.0
v0.*
v0.5.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.6
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45296.json"