Vulnerable code sample

from flask import Flask, request, jsonify

# This code is a simplified representation of the vulnerability described in
# CVE-2026-45296 for educational purposes. It does not use the actual
# OpenReplay codebase but mimics the flawed authorization logic.

app = Flask(__name__)

# --- Simulated Database ---
# In a real application, this data would be in a database.

# We have two tenants: Tenant 1 (Attacker) and Tenant 2 (Victim)
API_KEYS = {
    "attacker-api-key-for-tenant-1": {"tenant_id": 1},
    "victim-api-key-for-tenant-2": {"tenant_id": 2}
}

PROJECTS = {
    "attacker-project-A1": {"tenant_id": 1},
    "victim-public-project-B1": {"tenant_id": 2} # This key is publicly exposed
}

SESSIONS = {
    "attacker-project-A1": [
        {"sessionId": "attacker-session-123", "data": "some normal data"}
    ],
    "victim-public-project-B1": [
        {"sessionId": "victim-session-xyz", "data": "sensitive user PII and session events"}
    ]
}

# --- Vulnerable API Endpoint ---

@app.route("/sessions-vulnerable", methods=["GET"])
def get_project_sessions():
    """
    This endpoint is vulnerable to CVE-2026-45296.
    An attacker can use their own valid API key to access sessions from
    another tenant's project.
    """
    auth_header = request.headers.get("Authorization")
    if not auth_header or not auth_header.startswith("Bearer "):
        return jsonify({"error": "Authorization header is missing or invalid"}), 401

    api_key = auth_header.split(" ")[1]

    # Check if the API key is valid at all.
    if api_key not in API_KEYS:
        return jsonify({"error": "Invalid API Key"}), 401

    # Get the target projectKey from the query parameters.
    # An attacker would provide the victim's public projectKey here.
    project_key = request.args.get("projectKey")
    if not project_key:
        return jsonify({"error": "projectKey parameter is required"}), 400

    # VULNERABILITY: The code checks if the API key is valid and if the project exists,
    # but it does NOT verify that the API key is authorized for the requested project's tenant.
    # It fails to check if the tenant_id of the api_key matches the tenant_id of the project_key.

    # 1. Authenticate: The API key is valid (exists in API_KEYS).
    #    -> Attacker uses "attacker-api-key-for-tenant-1", which is valid.
    # 2. Check existence: The project key is valid (exists in PROJECTS).
    #    -> Attacker uses "victim-public-project-B1", which is valid.
    # 3. Authorize: THIS STEP IS MISSING.
    #    -> The code should check if API_KEYS[api_key]['tenant_id'] == PROJECTS[project_key]['tenant_id']
    #       but it does not.

    if project_key in PROJECTS:
        # Because the cross-tenant authorization check is missing, the code
        # proceeds to fetch and return data from the victim's project.
        project_sessions = SESSIONS.get(project_key, [])
        return jsonify(project_sessions), 200
    else:
        return jsonify({"error": "Project not found"}), 404

if __name__ == '__main__':
    # To test the vulnerability:
    # 1. Run this script.
    # 2. Use a tool like curl to send the following request:
    #
    # curl -X GET 'http://127.0.0.1:5000/sessions-vulnerable?projectKey=victim-public-project-B1' \
    # -H 'Authorization: Bearer attacker-api-key-for-tenant-1'
    #
    # The response will incorrectly return the sensitive session data from the victim's project.
    app.run(debug=False)