CVE-2026-55881

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55881
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55881.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55881
Aliases
  • GHSA-w2x5-m7w5-479h
Published
2026-07-10T20:44:15.897Z
Modified
2026-07-14T03:56:22.632773521Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint
Details

OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester's tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant's first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55881.json"
}
References

Affected packages

Git / github.com/openreplay/openreplay

Affected ranges

Type
GIT
Repo
https://github.com/openreplay/openreplay
Events
Introduced
b4d0598f23c0caf9724d42a953440962616fec17
Fixed
d356e18fdafdaa06b8c2897bfb8a485ec112fcc4
Fixed
ddd09117f644a309c7b040cda0a11ff9433e9e49
Database specific 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.22.0"
        },
        {
            "fixed": "1.27.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55881.json"