PHP CVE-2026-33043

No special conditions — remote unauthenticated exploitation of /objects/phpsessionid.json.php endpoint. Victim must visit attacker-controlled page sending cross-origin request to steal PHP session ID and enable account takeover via CORS header reflection.

This vulnerability presents a high real-world risk based on multiple exploitation signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates network-accessible attacks with low complexity requiring no privileges but user interaction. While no EPSS score or KEV listing was provided in the intelligence, the existence of a working proof-of-concept significantly increases exploitation likelihood. The attack is automatable through malicious advertisements or watering hole attacks, and the technical impact is severe (full account compromise). This is a genuine high-priority issue rather than a theoretical risk, as session hijacking attacks are commonly automated and the only barrier is getting a victim to visit an attacker-controlled page.

An attacker creates a malicious webpage or injects JavaScript into a compromised site that makes a cross-origin fetch request to the victim's AVideo instance at /objects/phpsessionid.json.php. When any logged-in AVideo user visits this page, their browser automatically sends their session cookie due to the permissive CORS policy, and the endpoint returns their session ID which the attacker captures and uses to impersonate the victim with full privileges. A working proof-of-concept is included in the vulnerability disclosure, making exploitation trivial for attackers.