CVE-2026-33043
published 2026-03-20CVE-2026-33043: WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any…
PriorityP348high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.34%
26.3th percentile
WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. This issue has been fixed in version 26.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | < 26.0 | 26.0 |
| wwbn | avideo | 0 – 25.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
ghsa·2026-03-17
CVE-2026-33043 [HIGH] CWE-942 AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
### Summary
`/objects/phpsessionid.json.php` exposes the current PHP session ID to any unauthenticated request. The `allowOrigin()` function reflects any `Origin` header back in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`, enabling cross-origin session theft and full account takeover.
### Details
**File:** `objects/phpsessionid.json.php`
```php
allowOrigin();
$obj = new stdClass();
$obj->phpsessid = session_id();
echo _json_encode($obj);
```
No authentication is required. The `allowOrigin()` function in `objects/functions.php` (line ~2648) reflects the request Origin:
```php
$HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_S
OSV
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
osv·2026-03-17
CVE-2026-33043 [HIGH] AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS
### Summary
`/objects/phpsessionid.json.php` exposes the current PHP session ID to any unauthenticated request. The `allowOrigin()` function reflects any `Origin` header back in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`, enabling cross-origin session theft and full account takeover.
### Details
**File:** `objects/phpsessionid.json.php`
```php
allowOrigin();
$obj = new stdClass();
$obj->phpsessid = session_id();
echo _json_encode($obj);
```
No authentication is required. The `allowOrigin()` function in `objects/functions.php` (line ~2648) reflects the request Origin:
```php
$HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_S
No detection rules found.
No public exploits indexed.
2026-03-20
Published