CVE-2026-33492

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

Summary

AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session.

Details

The vulnerability is a chain of three weaknesses that together enable session fixation:

1. Attacker-controlled session ID acceptance (objects/functionsPHP.php:344-367)

function _session_start(array $options = [])
{
    // ...
    if (isset($_GET['PHPSESSID']) && !_empty($_GET['PHPSESSID'])) {
        $PHPSESSID = $_GET['PHPSESSID'];
        // ...
        if (!User::isLogged()) {
            if ($PHPSESSID !== session_id()) {
                _session_write_close();
                session_id($PHPSESSID);   // <-- sets session to attacker's ID
            }
            $session = @session_start($options);  // <-- starts with attacker's ID

The code reads $_GET['PHPSESSID'] and programmatically calls session_id($PHPSESSID), which bypasses both session.use_only_cookies and session.use_strict_mode PHP settings since the session ID is set via the PHP API, not via cookie/URL handling.

2. Session regeneration bypass for blacklisted endpoints (objects/functionsPHP.php:375-378, objects/functions.php:3100-3116)

// functionsPHP.php:375-378
if (!blackListRegenerateSession()) {
    _session_regenerate_id();  // <-- SKIPPED when blacklisted + same-domain
}

// functions.php:3100-3116
function blackListRegenerateSession()
{
    if (!requestComesFromSafePlace()) {
        return false;
    }
    $list = [
        'objects/getCaptcha.php',
        'objects/userCreate.json.php',
        'objects/videoAddViewCount.json.php',
    ];
    foreach ($list as $needle) {
        if (str_ends_with($_SERVER['SCRIPT_NAME'], $needle)) {
            return true;  // <-- regeneration skipped for these endpoints
        }
    }
    return false;
}

The requestComesFromSafePlace() check at objects/functionsSecurity.php:182 only verifies that HTTP_REFERER matches the AVideo domain. When a victim clicks a link from within the AVideo platform (e.g., in a comment or video description), the browser naturally sets the Referer to the AVideo domain, satisfying this check.

3. Disabled session regeneration on login (objects/user.php:1315-1317)

// Call custom session regenerate logic
// this was regenerating the session all the time, making harder to save info in the session
//_session_regenerate_id();  // <-- COMMENTED OUT

The session regeneration after authentication is explicitly disabled. This means the session ID persists unchanged through the login transition, which is the fundamental requirement for session fixation to succeed.

Amplifying factors

• objects/phpsessionid.json.php exposes session IDs to any same-origin JavaScript without authentication (line 12: $obj->phpsessid = session_id())
• view/js/session.js stores the session ID in a global window.PHPSESSID variable and logs it to console (line 15)
• No session-to-IP or session-to-user-agent binding exists (verified via codebase search)

PoC

Step 1: Attacker obtains a session ID

# Attacker visits the site to get a valid session ID
curl -v https://target.example.com/ 2>&1 | grep 'set-cookie.*PHPSESSID'
# Response: Set-Cookie: PHPSESSID=attacker_known_session_id; ...

Step 2: Attacker injects a link on the platform

The attacker posts a comment on a video or creates content containing a link:

https://target.example.com/objects/getCaptcha.php?PHPSESSID=attacker_known_session_id

This can be placed in a video comment, video description, user bio, or forum post —…

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.

Summary

AVideo's _session_start() function accepts arbitrary session IDs via the PHPSESSID GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in User::login(), this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session.

Details

The vulnerability is a chain of three weaknesses that together enable session fixation:

1. Attacker-controlled session ID acceptance (objects/functionsPHP.php:344-367)

function _session_start(array $options = [])
{
    // ...
    if (isset($_GET['PHPSESSID']) && !_empty($_GET['PHPSESSID'])) {
        $PHPSESSID = $_GET['PHPSESSID'];
        // ...
        if (!User::isLogged()) {
            if ($PHPSESSID !== session_id()) {
                _session_write_close();
                session_id($PHPSESSID);   // <-- sets session to attacker's ID
            }
            $session = @session_start($options);  // <-- starts with attacker's ID

The code reads $_GET['PHPSESSID'] and programmatically calls session_id($PHPSESSID), which bypasses both session.use_only_cookies and session.use_strict_mode PHP settings since the session ID is set via the PHP API, not via cookie/URL handling.

2. Session regeneration bypass for blacklisted endpoints (objects/functionsPHP.php:375-378, objects/functions.php:3100-3116)

// functionsPHP.php:375-378
if (!blackListRegenerateSession()) {
    _session_regenerate_id();  // <-- SKIPPED when blacklisted + same-domain
}

// functions.php:3100-3116
function blackListRegenerateSession()
{
    if (!requestComesFromSafePlace()) {
        return false;
    }
    $list = [
        'objects/getCaptcha.php',
        'objects/userCreate.json.php',
        'objects/videoAddViewCount.json.php',
    ];
    foreach ($list as $needle) {
        if (str_ends_with($_SERVER['SCRIPT_NAME'], $needle)) {
            return true;  // <-- regeneration skipped for these endpoints
        }
    }
    return false;
}

The requestComesFromSafePlace() check at objects/functionsSecurity.php:182 only verifies that HTTP_REFERER matches the AVideo domain. When a victim clicks a link from within the AVideo platform (e.g., in a comment or video description), the browser naturally sets the Referer to the AVideo domain, satisfying this check.

3. Disabled session regeneration on login (objects/user.php:1315-1317)

// Call custom session regenerate logic
// this was regenerating the session all the time, making harder to save info in the session
//_session_regenerate_id();  // <-- COMMENTED OUT

The session regeneration after authentication is explicitly disabled. This means the session ID persists unchanged through the login transition, which is the fundamental requirement for session fixation to succeed.

Amplifying factors

• objects/phpsessionid.json.php exposes session IDs to any same-origin JavaScript without authentication (line 12: $obj->phpsessid = session_id())
• view/js/session.js stores the session ID in a global window.PHPSESSID variable and logs it to console (line 15)
• No session-to-IP or session-to-user-agent binding exists (verified via codebase search)

PoC

Step 1: Attacker obtains a session ID

# Attacker visits the site to get a valid session ID
curl -v https://target.example.com/ 2>&1 | grep 'set-cookie.*PHPSESSID'
# Response: Set-Cookie: PHPSESSID=attacker_known_session_id; ...

Step 2: Attacker injects a link on the platform

The attacker posts a comment on a video or creates content containing a link:

https://target.example.com/objects/getCaptcha.php?PHPSESSID=attacker_known_session_id

This can be placed in a video comment, video description, user bio, or forum post —…