What’s Vulnerable › Vulnerabilities

CVE-2026-33043: AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-20 · updated 2026-06-17
• Weakness: CWE-942

Description

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. This issue has been fixed in version 26.0.

Affected products

• WWBN AVideo: before 26.0 — fixed in 26.0

How to fix

Upgrade to a fixed version: WWBN AVideo 26.0. Check the vendor advisory for mitigations.

References

• https://github.com/WWBN/AVideo/commit/9f4f51e5df5e3343400f9d0068705f5482b6f930
• https://github.com/WWBN/AVideo/security/advisories/GHSA-qc3p-398r-p59j

Get alerted when CVE-2026-33043 or the next vulnerability affects your stack