Openreplay vulnerabilities
We track 5 vulnerabilities in Openreplay products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2026.
Latest Openreplay vulnerabilities
- 7.1 High severity
openreplay: Authorization Bypass Through User-Controlled Key
OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only tha
- 7.1 High severity
openreplay: Authorization Bypass Through User-Controlled Key
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project
- 9.3 Critical severity
openreplay: Improper Neutralization of Input During Web Page Generation
OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later
- 7.7 High severity
openreplay: Improper Access Control
OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only that the API key itself is valid and that the target projectKey exists. T
- 9.8 Critical severity
openreplay: Improper Neutralization of Special Elements used in an SQL Command
OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.