OpenReplay’s POST /{projectId}/cards/search endpoint contains a SQL injection through the unvalidated sort.field parameter. An attacker can inject arbitrary SQL statements, potentially reading, modifying, or deleting data stored in the database, including sensitive session information. The weakness is a classic injection flaw, classified as CWE‑89.

OpenReplay is affected for all self‑hosted instances running any version prior to 1.20.0. The flaw exists in the openreplay openreplay product and is present in all installations exposing the cards/search API, regardless of deployment size or configuration.

The CVSS score of 6.9 denotes a medium severity vulnerability. The EPSS score is below 1%, indicating a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Attackers would need network access to the API endpoint and the capability to supply a malicious sort.field value, typically via HTTP POST requests. Successful exploitation would allow unauthorized data reads or modifications, compromising confidentiality and integrity of the stored data.