Oopenreplay

Products

Exploited and recent CVEs

• CVE-2026-57230 Medium 5.4 OpenReplay: Authenticated ClickHouse SQL injection via session search 0.3%
• CVE-2026-55881 High 7.1 OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint 0.4%
• CVE-2026-55880 High 7.1 OpenReplay: Cross-user IDOR in notes and dashboard widgets 0.3%
• CVE-2026-55879 Critical 9.3 OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover 0.5%
• CVE-2026-45296 High 7.7 OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding 0.2%
• CVE-2026-45297 Medium 5.3 Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch 0.2%
• CVE-2026-28443 Medium 6.9 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter 0.4%
• CVE-2023-48226 Medium 6.5 OpenReplay HTML Injection vulnerability 0.8%