A vulnerability in OpenReplay’s Python API allows an authenticated attacker to exploit a missing tenant binding for projectKey parameters. When a requester supplies a valid API key, the API only verifies the key's validity and that the target projectKey exists, but it does not confirm that the projectKey belongs to the same tenant as the API key. This flaw permits an attacker who owns an API key for one tenant to reuse a public projectKey belonging to another tenant to enumerate that tenant’s user sessions and retrieve sensitive session event data, effectively leaking information across tenant boundaries. The weakness corresponds to configuration error (CWE‑284).

All installations of OpenReplay using a Python API prior to version 1.26.0 are impacted, regardless of deployment environment or deployment scale. The affected component is the app_apikey module that processes projectKey requests.

The vulnerability carries a CVSS score of 7.7, indicating a high severity risk. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, but the exploitation likelihood remains significant because the attack requires only possession of a valid API key and knowledge of a public projectKey, both of which an attacker can acquire easily. Successful exploitation leads to cross‑tenant disclosure of user sessions and session events, compromising confidentiality for the affected tenant.