AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33492
CWE: CWE-384
CVSS: 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

## Summary AVideo's `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim's session ID before authentication and then hijack the authenticated session. ## Details The vulnerability is a chain of three weaknesses that together enable session fixation: ### 1. Attacker-controlled session ID acceptance (`objects/functionsPHP.php:344-367`) ```php function _session_start(array $options = []) { // ... if (isset($_GET['PHPSESSID']) && !_empty($_GET['PHPSESSID'])) { $PHPSESSID = $_GET['PHPSESSID']; // ... if (!User::isLogged()) { if ($PHPSESSID !== session_id()) { _session_write_close(); session_id($PHPSESSID); // <-- sets session to attacker's ID } $session = @session_start($options); // <-- starts with attacker's ID ``` The code reads `$_GET['PHPSESSID']` and programmatically calls `session_id($PHPSESSID)`, which bypasses both `session.use_only_cookies` and `session.use_strict_mode` PHP settings since the session ID is set via the PHP API, not via cookie/URL handling. ### 2. Session regeneration bypass for blacklisted en


Mitigations:

Architectural layers (MAESTRO):