PoC Index

CVE-2026-33043

HIGH 8.1EPSS 0.3%

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. This issue has been fixed in version 26.0.

CVSS v3.1
8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v3.1
8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS
0.34% chance of exploitation in the next 30 days, 27th percentile
Published
2026-03-20
Updated
2026-03-25

Proof-of-concept exploits (1)

References

Related