CVE-2026-33492

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's "sessionstart" function accepts arbitrary session IDs via the "PHPSESSID" GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints whe...