CVE-2026-33043 AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

What is CVE-2026-33043?

CVE-2026-33043 is a high-severity vulnerability in Wwbn Avideo, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. This issue has been fixed in version 26.0.

Weakness: CWE-942

Which versions are affected by CVE-2026-33043?

2 open source packages ship an affected version, including wwbn/avideo. It affects 1 product.

Products include Wwbn Avideo.

How do I fix CVE-2026-33043?

No fix has been published for CVE-2026-33043 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33043 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33043 exists.

Other vulnerabilities in Wwbn Avideo

• CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks Critical 10.0
• CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection Critical 10.0
• CVE-2022-30534 Command injection in AVideo Critical 9.9
• CVE-2022-30547 Path traversal in AVideo Critical 9.9
• CVE-2022-32572 Command injection in AVideo Critical 9.9

All Wwbn Avideo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qc3p-398r-p59j.