CVE-2026-33043Disclosure(wwbn / avideo)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. This issue has been fixed in version 26.0.

wwbn CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/WWBN/AVideo/commit/9f4f51e5df5e3343400f9d0068705f5482b6f930

Exploit / PoC references

https://github.com/WWBN/AVideo/security/advisories/GHSA-qc3p-398r-p59j

Weakness type (CWE)

CWE-942

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

avideo

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 2d ago at 1 mentions (2026-03-20); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

wwbn

Products

avideo

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

PulsePatch.io@pulsepatchio202d
Disclosure
AVideo is impacted by a session hijacking vulnerability (CVE-2026-33043) via unauthenticated session ID disclosure and permissive CORS, risking unauthorized access. #AVideo #SessionHijacking #infosec https://www.pulsepatch.io/posts/cve-2026-33043-avideo-session-hijacking
Post summary
The tweet announces a session hijacking vulnerability (CVE-2026-33043) in AVideo, detailing the exploit vector via session ID disclosure and permissive CORS, with no PoC, exploit code, patch reference, or active exploitation claims.
0000034
2 followersView on X
The Hacker Wire@TheHackerWire202d
Disclosure
🟠 CVE-2026-33043 - High WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() f... https://www.thehackerwire.com/vulnerability/CVE-2026-33043/ https://t.co/vtabLEvKRO
Post summary
The tweet announces that versions 25.0 and below of WWBN AVideo expose the PHP session ID through an unauthenticated endpoint, highlighting a vulnerability that can be exploited.
0000046
138 followersView on X
CVE@CVEnew204d
Disclosure
CVE-2026-33043 WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated req… https://www.cve.org/CVERecord?id=CVE-2026-33043
Post summary
The passage announces CVE-2026-33043, stating that AVideo versions 25.0 and below expose the PHP session ID via /objects/phpsessionid.json.php, but it does not provide any PoC, exploit, or patch information.
0000068
56.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wwbn	avideo	-	-	-

Explore more

Back to dashboard wwbn CVEs avideo vulnerabilities