Session Fixation Vulnerability in AVideo Open Source Video Platform

CVE-2026-33492

What is CVE-2026-33492?

AVideo, an open source video platform by WWBN, has a vulnerability in its session management mechanism. In versions up to 26.0, the function _session_start() improperly handles arbitrary session IDs through the PHPSESSID GET parameter, which can lead to a session fixation attack. The vulnerability arises when the request comes from the same domain, allowing an attacker to manipulate the session ID before the victim authenticates. This can result in the attacker hijacking the victim's session. A patch has been implemented to address this issue, ensuring better security practices in the management of user sessions.

References