CVE-2026-33492

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33492", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T16:16:48.971Z", "datePublished": "2026-03-23T15:25:27.288Z", "dateUpdated": "2026-03-23T15:40:38.783Z"}, "containers": {"cna": {"title": "AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration", "problemTypes": [{"descriptions": [{"cweId": "CWE-384", "lang": "en", "description": "CWE-384: Session Fixation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43"}, {"name": "https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785", "tags": ["x_refsource_MISC"], "url": "https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T15:25:27.288Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch."}], "source": {"advisory": "GHSA-x3pr-vrhq-vq43", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:40:34.799115Z", "id": "CVE-2026-33492", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:40:38.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33492", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-23T15:40:34.799115Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:40:21.998Z"}}], "cna": {"title": "AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration", "source": {"advisory": "GHSA-x3pr-vrhq-vq43", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785", "name": "https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384: Session Fixation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T15:25:27.288Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33492", "state": "PUBLISHED", "dateUpdated": "2026-03-23T15:40:38.783Z", "dateReserved": "2026-03-20T16:16:48.971Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-23T15:25:27.288Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, la funci\u00f3n '_session_start()' de AVideo acepta IDs de sesi\u00f3n arbitrarios a trav\u00e9s del par\u00e1metro GET 'PHPSESSID' y los establece como la sesi\u00f3n PHP activa. Existe un bypass de regeneraci\u00f3n de sesi\u00f3n para endpoints espec\u00edficos en la lista negra cuando la solicitud se origina desde el mismo dominio. Combinado con la regeneraci\u00f3n de sesi\u00f3n expl\u00edcitamente deshabilitada en 'User::login()', esto permite un ataque cl\u00e1sico de fijaci\u00f3n de sesi\u00f3n donde un atacante puede fijar el ID de sesi\u00f3n de una v\u00edctima antes de la autenticaci\u00f3n y luego secuestrar la sesi\u00f3n autenticada. El commit 5647a94d79bf69a972a86653fe02144079948785 contiene un parche."}], "id": "CVE-2026-33492", "lastModified": "2026-06-17T10:37:35.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33492", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:40:34.799115Z", "version": "2.0.3"}}]}, "published": "2026-03-23T16:16:49.257", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WWBN/AVideo/commit/5647a94d79bf69a972a86653fe02144079948785"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x3pr-vrhq-vq43"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-03-24T19:39:09.052393+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch included in commit 5647a94d79bf69a972a86653fe02144079948785 which updates the _session_start() function and re\u2011enables session regeneration during login.", "Upgrade the AVideo installation to version 27.0 or later, ensuring the session security changes are in place.", "Verify that the PHPSESSID GET parameter is no longer accepted as a session identifier and that session regeneration is enabled during login.", "As a temporary protection, consider blocking or ignoring PHPSESSID values passed in the query string until the official patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Session Hijacking"}, "threat_synthesis": {"affected_systems": "The affected vendor is WWBN, with its open\u2011source AVideo video platform. Versions up to and including 26.0 contain the flaw. No additional version sub\u2011sets are specified in the advisory.", "description_and_impact": "A video platform is vulnerable to session fixation. The platform\u2019s session start routine accepts arbitrary session identifiers provided via the PHPSESSID GET parameter. Because the login process deliberately disables session regeneration, an attacker can predefine a victim\u2019s session ID before the victim logs in and subsequently hijack the authenticated session. This enables the attacker to impersonate the user and access or manipulate the user\u2019s data and actions. The weakness directly maps to a session fixation attack.", "risk_and_exploitability": "The CVSS score is 7.3, indicating a high severity, while the EPSS score is below 1%, implying a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by delivering a crafted URL containing a desired PHPSESSID to a victim on the same domain. Since the application does not regenerate the session identifier after authentication, the attacker can reuse this identifier to obtain the victim\u2019s authenticated session. The exploitation requires only a web browser interaction and does not need local code execution or privileged access."}}}}, "created": "2026-03-24T10:33:40.388122+00:00", "updated": "2026-03-25T20:37:31.900619+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}