CVE-2026-55881

Received Received - Intake

OpenReplay Session Replay Data Exposure

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter, while validateProjectAccess checked only that the project belonged to the requester's tenant and did not verify that the session belonged to that project, allowing any authenticated low-privilege user to read another tenant's first 15 seconds of session-replay recording data. This issue is fixed in version 1.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-55881

Affected Vendors & Products

Vendor	Product	Version / Range
openreplay	openreplay	to 1.27.0 (exc)
openreplay	openreplay	1.27.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Compliance Impact

The vulnerability allows any authenticated low-privilege user to access the first 15 seconds of session-replay recording data from another tenant without proper authorization.

This unauthorized access to session replay data could lead to exposure of sensitive user information, potentially violating data protection regulations such as GDPR and HIPAA, which require strict controls on personal and health-related data access.

Therefore, the vulnerability undermines compliance with these standards by failing to adequately protect user session data from unauthorized access.

Executive Summary

This vulnerability exists in OpenReplay versions from 1.22.0 before 1.27.0. The function getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-replay recording based only on the session path parameter.

The validation function validateProjectAccess only checked that the project belonged to the requester's tenant but did not verify that the session actually belonged to that project.

As a result, any authenticated low-privilege user could access the first 15 seconds of session-replay recording data from another tenant, leading to unauthorized data exposure.

This issue was fixed in version 1.27.0.

Impact Analysis

This vulnerability allows an authenticated low-privilege user to access the first 15 seconds of session-replay recordings from other tenants without proper authorization.

Such unauthorized access can lead to exposure of sensitive user interaction data, potentially compromising privacy and confidentiality.

This could result in data leakage, loss of trust, and potential misuse of the exposed session data.

Mitigation Strategies

The vulnerability is fixed in OpenReplay version 1.27.0. The immediate step to mitigate this vulnerability is to upgrade OpenReplay to version 1.27.0 or later.

Hi! I’m here to help you understand CVE-2026-55881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70