Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M

CVE-2026-33492AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

High 7.3

In plain English

A high-severity session fixation in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-x3pr-vrhq-vq43

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 26.0

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43 x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785 x_refsource_MISC