Loading vulnerability…
Session ID Exposure and CORS Misconfiguration in WWBN AVideo
CVE-2026-33043 affects WWBN AVideo, an open source video platform. In AVideo 25.0 and earlier, the endpoint /objects/phpsessionid.json.php returns the current PHP session ID to unauthenticated requests. The issue is compounded by the application's allowOrigin() behavior, which reflects arbitrary Origin headers into Access-Control-Allow-Origin and sets Access-Control-Allow-Credentials: true. This combination creates a cross-origin data exposure condition in which an attacker-controlled site can induce a victim's browser to make a credentialed cross-origin request and read back the victim's active session identifier. With the stolen PHP session ID, an attacker can hijack the victim's authenticated session and take over the account. The issue was fixed in version 26.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables theft of a victim's active PHP session identifier and subsequent session hijacking. Because the exposed value corresponds to the authenticated user's current session, an attacker can impersonate that user without needing credentials, resulting in full account takeover. The stated impact is high confidentiality and integrity loss, with no specific availability impact noted.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, disable or block access to /objects/phpsessionid.json.php at the web server or reverse proxy, especially from untrusted origins. Reconfigure CORS to use a strict allowlist of trusted origins and do not combine reflected origins with Access-Control-Allow-Credentials: true. Invalidate existing sessions after applying changes to reduce the value of previously exposed session IDs, and monitor for anomalous session reuse or account activity indicative of hijacking.
Patch, then assume compromise.
Upgrade WWBN AVideo to version 26.0 or later, which contains the fix for CVE-2026-33043. The vulnerable behavior in /objects/phpsessionid.json.php should be removed or restricted so that session identifiers are never disclosed to unauthenticated or client-accessible contexts. CORS handling should also be corrected so that arbitrary Origin values are not reflected and credentialed cross-origin access is only allowed for explicitly trusted origins.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.