CVE-2026-33492

Summary

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

Affected Software

Weaknesses

• CWE-384: CWE-384: Session Fixation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43
• https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785

• ←Previous
• Next→