Home / Vulnerability Intelligence / CVE-2026-33043

CVE-2026-33043 - Vulnerability Analysis

HighCVSS: 8.1

Last Updated: March 20, 2026

WWBN AVideo - Stored XSS & Authentication Bypass

Published: March 20, 2026Updated: March 20, 2026Remote Exploitable

Overview

WWBN AVideo <= 25.0 contains a cross-site scripting vulnerability caused by reflection of Origin header in Access-Control-Allow-Origin with credentials enabled, letting unauthenticated attackers steal sessions and take over accounts, exploit requires crafted cross-origin request.

Severity & Score

Severity: High

CVSS Score: 8.1

EPSS Score: 3.0%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can steal session IDs via cross-origin requests, leading to full account takeover.

Mitigation

Update to version 26.0 or later.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 20, 2026

🟠 CVE-2026-33043 - High (8.1) WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Contro... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33043/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 20, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-33043
Severity: High
CVSS Score: 8.1
Type: stored_xss
Status: unconfirmed
EPSS: 3.0%
Social Posts: 2

CWE

CWE-942

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS Score

3.0%Probability of exploitation in the next 30 days