CVE-2026-33492: 
PHP vulnerability analysis and mitigation

CVE-2026-33492 is a session fixation vulnerability in WWBN AVideo (versions up to and including 26.0) that allows an authenticated attacker with low privileges to hijack any user's authenticated session, including administrator accounts, by fixing a victim's session ID before authentication. The vulnerability was published on March 20, 2026, by the AVideo maintainer (DanielnetoDotCom) and added to the NVD on March 23, 2026. It carries a CVSS v3.1 base score of 7.3 (High) (Github Advisory).

The vulnerability (CWE-384: Session Fixation) is a chain of three weaknesses in AVideo's PHP session management. First, the _session_start() function in objects/functionsPHP.php (lines 344–367) reads an arbitrary session ID from the $_GET['PHPSESSID'] parameter and sets it via session_id($PHPSESSID), bypassing PHP's session.use_only_cookies and session.use_strict_mode protections since the ID is set through the PHP API directly. Second, a session regeneration bypass exists for blacklisted endpoints (getCaptcha.php, userCreate.json.php, videoAddViewCount.json.php) when the HTTP Referer matches the AVideo domain — a condition trivially satisfied when a victim clicks an attacker-crafted link within the platform. Third, session regeneration on login in User::login() (objects/user.php:1317) is explicitly commented out, meaning the session ID persists unchanged after authentication. Amplifying factors include objects/phpsessionid.json.php exposing session IDs to same-origin JavaScript and view/js/session.js storing the session ID in a global window.PHPSESSID variable (Github Advisory, AVideo Security Advisory).

Successful exploitation enables full account takeover of any AVideo user, including administrators, allowing the attacker to access all of the victim's videos, private content, messages, and personal information. If the compromised account has administrative privileges, the attacker gains full control over the AVideo instance — including the ability to upload or delete content, modify platform settings, and access the admin panel. There is no availability impact, but confidentiality and integrity are both fully compromised for the affected account (Github Advisory).

A detailed proof-of-concept exploit with step-by-step curl commands is publicly available in the GitHub Security Advisory, and Feedly classifies it as a real exploit with high confidence (AVideo Security Advisory). Exploitation requires the attacker to have low-level authenticated access to the platform (e.g., to post a comment or link) and requires the victim to click a crafted link. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.069% (0.099% per GitHub Advisory), placing it in the 27th percentile for exploitation likelihood (Github Advisory).

1. Obtain a session ID: The attacker visits the target AVideo instance and captures a valid session ID from the Set-Cookie response header: curl -v https://target.example.com/ 2>&1 | grep 'set-cookie.*PHPSESSID'
2. Inject a crafted link: The attacker posts a comment, video description, user bio, or forum post on the AVideo platform containing a link that embeds the known session ID as a GET parameter, e.g.: https://target.example.com/objects/getCaptcha.php?PHPSESSID=attacker_known_session_id
3. Victim clicks the link: When the victim (who is not yet logged in) clicks the link from within the AVideo platform, the browser sets a same-domain Referer header. The _session_start() function reads $_GET['PHPSESSID'] and calls session_id('attacker_known_session_id'), fixing the victim's session to the attacker's known ID. Because getCaptcha.php is on the blacklist and the Referer is same-domain, _session_regenerate_id() is skipped.
4. Victim authenticates: The victim navigates to the login page and logs in. User::login() populates $_SESSION['user'] but does NOT regenerate the session ID (the call is commented out at line 1317), so the session ID remains attacker_known_session_id.
5. Attacker hijacks the session: The attacker uses the known session ID to impersonate the victim: curl -b "PHPSESSID=attacker_known_session_id" https://target.example.com/objects/user.php?userAPI=1 — the response returns the victim's user data, confirming full session hijack (AVideo Security Advisory).

• Network: HTTP GET requests to objects/getCaptcha.php, objects/userCreate.json.php, or objects/videoAddViewCount.json.php containing a PHPSESSID query parameter (e.g., GET /objects/getCaptcha.php?PHPSESSID=<value>); subsequent authenticated requests using the same session ID from a different IP address or user agent.
• Logs: AVideo/PHP access logs showing the same PHPSESSID value used first in an unauthenticated request to a blacklisted endpoint and later in authenticated API calls (e.g., objects/user.php?userAPI=1); requests to objects/phpsessionid.json.php from unexpected origins.
• File System: No direct file artifacts expected from this attack type, but review for unauthorized content uploads, deleted videos, or modified settings that may indicate post-compromise activity.
• Process/Behavior: Unexpected administrative actions (content deletion, settings changes, new admin accounts) performed under a legitimate user's session; session activity from geographically or temporally inconsistent locations for the same session ID (AVideo Security Advisory).

The vulnerability was patched in commit 5647a94 on the AVideo GitHub repository. The fix re-enables _session_regenerate_id() in User::login() (objects/user.php:1317), adds format validation for GET-supplied session IDs (alphanumeric + comma/hyphen, 22–256 chars via regex), and refactors session ID handling in JavaScript. All organizations running AVideo version 26.0 or earlier should upgrade to the patched version immediately. As interim mitigations, administrators should audit active sessions for unauthorized access, review logs for session fixation indicators, consider restricting user-generated link rendering, and implement MFA where possible (Github Advisory, AVideo Patch Commit).

The vulnerability was reported by a researcher credited as "offset" and published by AVideo maintainer DanielnetoDotCom on March 20, 2026. The advisory was noted on Bluesky via the CVE tracking account shortly after NVD publication. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (Github Advisory).