CVE-2026-55881: OpenReplay Information Disclosure Flaw

CVE-2026-55881 Overview

CVE-2026-55881 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in OpenReplay, a self-hosted session replay suite. Affected versions from 1.22.0 before 1.27.0 expose the getFirstMob handler, which returns 15-second presigned S3 download URLs for a session's DOM-replay recording based solely on the session path parameter. The validateProjectAccess function verifies that the project belongs to the requester's tenant but does not verify that the session belongs to that project. Any authenticated low-privilege user can read the first 15 seconds of another tenant's session-replay recordings. The issue is fixed in version 1.27.0.

Critical Impact
Authenticated low-privilege users can access session-replay recording data belonging to other tenants, resulting in cross-tenant confidentiality loss.

Affected Products

OpenReplay versions 1.22.0 through 1.26.x
OpenReplay self-hosted deployments serving multi-tenant workloads
OpenReplay getFirstMob API handler in backend/pkg/replays/api/handlers.go

Discovery Timeline

2026-07-10 - CVE-2026-55881 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55881

Vulnerability Analysis

The vulnerability resides in OpenReplay's backend session-replay handler. When a client requests the first-mob recording, the getFirstMob function accepts a sessID from the URL path and issues a 15-second presigned Amazon S3 URL that points to the DOM-replay recording for that session. Authorization is delegated to validateProjectAccess, which confirms the caller's tenant owns the referenced project. The handler never verifies that the requested sessID belongs to the validated project. An authenticated user can therefore substitute any numeric session identifier and receive a presigned URL for another tenant's recording.

The exposure is limited to the first 15 seconds of DOM-replay data per request, but there is no rate limit on session-ID enumeration. Session replays commonly contain form input, personally identifiable information, authentication tokens rendered in the DOM, and application state, making the data highly sensitive.

Root Cause

The root cause is missing object ownership validation between the session and project scopes. Access control enforced project-tenant binding but not session-project binding, breaking the multi-tenant isolation boundary [CWE-639].

Attack Vector

An authenticated attacker with a low-privilege account on any tenant iterates over session identifiers and calls the first-mob endpoint. Each successful call returns a presigned S3 URL usable for 15 seconds to download recording data from arbitrary tenants over the network.

// Source: https://github.com/openreplay/openreplay/commit/ddd09117f644a309c7b040cda0a11ff9433e9e49
// Security patch in backend/pkg/replays/api/handlers.go
// fix(backend): add session ownership check to first-mob handler (#4692)

	h.log.Info(r.Context(), "getFirstMob: sessID: %v, projID: %v", sessID, projID)

+	isSessionExists, err := h.sessions.IsExists(projID, sessID)
+	if err != nil {
+		h.responser.ResponseWithError(h.log, r.Context(), w, http.StatusInternalServerError, err, startTime, r.URL.Path, bodySize)
+		return
+	}
+	if !isSessionExists {
+		h.responser.ResponseWithError(h.log, r.Context(), w, http.StatusBadRequest, errors.New("wrong session id"), startTime, r.URL.Path, bodySize)
+		return
+	}
+
	urls, err := h.files.GetMobStartUrl(sessID)
	if err != nil {
		h.log.Error(r.Context(), "Error getting start urls: %v", err)

The patch adds an IsExists(projID, sessID) check that rejects requests when the session does not belong to the validated project.

Detection Methods for CVE-2026-55881

Indicators of Compromise

Unusual volume of requests from a single authenticated user to the first-mob endpoint (/sessions/{sessID}/first-mob or equivalent route).
Sequential or randomized sessID enumeration patterns in OpenReplay API access logs.
Presigned S3 GET requests originating from client IPs that do not match the tenant owning the retrieved session objects.

Detection Strategies

Correlate OpenReplay backend logs with the tenant ID of the requesting user and the tenant ID of the returned session; alert on mismatches.
Track distinct sessID values requested per user per hour and flag counts exceeding normal replay-review activity.
Monitor S3 access logs for high fan-out of presigned URLs tied to a single OpenReplay backend instance and low-privilege account.

Monitoring Recommendations

Enable structured logging of getFirstMob requests including userID, tenantID, projID, and sessID for retrospective analysis.
Forward OpenReplay application and S3 access logs to a central analytics platform for cross-tenant anomaly detection.
Review authentication logs for newly created low-privilege accounts that immediately access replay APIs.

How to Mitigate CVE-2026-55881

Immediate Actions Required

Upgrade OpenReplay to version 1.27.0 or later, which enforces session-to-project ownership validation.
Audit access logs for the first-mob endpoint since deployment of any affected version between 1.22.0 and 1.26.x.
Rotate any credentials, tokens, or secrets that may have appeared in the DOM of recorded sessions.

Patch Information

The fix is delivered in OpenReplay Release v1.27.0 via Pull Request #4692 and commit ddd0911. Details are documented in GitHub Security Advisory GHSA-w2x5-m7w5-479h.

Workarounds

Restrict OpenReplay backend access to trusted networks or VPN until the upgrade is applied.
Temporarily disable low-privilege accounts on shared multi-tenant deployments to reduce exposure.
Shorten S3 presigned URL lifetimes and enforce IP-based conditions on the bucket policy where feasible.

bash

# Upgrade OpenReplay self-hosted deployment to the patched release
git fetch --tags
git checkout v1.27.0

# Redeploy using the project's standard installation method (Helm example)
helm upgrade openreplay ./scripts/helmcharts/openreplay \
  --namespace app \
  --set global.openReplayContainerRegistry=public.ecr.aws/p1t3u8a3 \
  --set global.version=v1.27.0