8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33043

CVE-2026-33043: AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account takeover. This issue has been fixed in version 26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33043

CVE-2026-33043:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a session hijacking weakness caused by an insecure Cross-Origin Resource Sharing (CORS) configuration. The core of the issue is in the allowOrigin() function within objects/functions.php. This function improperly validated the origin of requests, reflecting any Origin header from the request into the Access-Control-Allow-Origin response header and setting Access-Control-Allow-Credentials: true. This allowed any website to make authenticated cross-origin requests.

The vulnerability was exposed through the objects/phpsessionid.json.php endpoint. This script, which retrieves the user's session ID using session_id(), called the vulnerable allowOrigin() function. An attacker could trick a logged-in user into visiting a malicious website, which would then make a cross-origin request to phpsessionid.json.php. Due to the flawed CORS policy, the attacker's site could read the response, capture the user's session ID, and hijack their session, gaining full control of the account.

The patch remediates this by modifying allowOrigin() to strictly validate the request's origin against the site's own configured origin before allowing credentialed access. Additionally, the call to allowOrigin() was removed entirely from phpsessionid.json.php, restricting its use to same-origin contexts as intended.

Vulnerable functions

allowOrigin

objects/functions.php

The `allowOrigin` function in `objects/functions.php` was vulnerable because it reflected the user-supplied `Origin` header in the `Access-Control-Allow-Origin` response header while also setting `Access-Control-Allow-Credentials: true`. This permissive CORS policy allowed any external domain to make credentialed requests and read the response, leading to the theft of sensitive information like session IDs.

session_id

objects/phpsessionid.json.php

The script `objects/phpsessionid.json.php` used the `session_id()` function to retrieve and expose the user's session ID. In the vulnerable version, this script called the insecure `allowOrigin()` function, which enabled cross-origin attackers to make a credentialed request to this endpoint and steal the session ID, leading to account takeover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.