CVE-2026-33492 PUBLISHED

AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

Assigner: GitHub_M
Reserved: 20.03.2026 Published: 23.03.2026 Updated: 23.03.2026

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 7.3

Product Status

Vendor WWBN
Product AVideo
Versions
  • Version <= 26.0 is affected

References

Problem Types

  • CWE-384: Session Fixation CWE