CVE-2026-33492 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a session fixation vulnerability caused by accepting arbitrary session IDs via the PHPSESSID GET parameter and disabled session regeneration, letting attackers hijack authenticated sessions, exploit requires same domain request to blacklisted endpoints.

Severity & Score

Impact

Attackers can hijack authenticated user sessions by fixing session IDs before login, leading to account compromise.

Mitigation

Update to a version including commit 5647a94d79bf69a972a86653fe02144079948785 or later.

References

• https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785
• https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner