https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:22:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276906 EUVD-2026-276906 https://cve.radiocsirt.org/vuln/euvd-2026-276906 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33492 <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo&#39;s `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim&#39;s session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.</p> <p>WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo&#39;s `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim&#39;s session ID before authentication and then hijack the authenticated session. Commit 5647a94d79bf69a972a86653fe02144079948785 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33492 https://cve.radiocsirt.org/vuln/ghsa-x3pr-vrhq-vq43 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>AVideo&#39;s `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim&#39;s session ID before authentication and then hijack the authenticated session.</p> <p>## Details</p> <p>The vulnerability is a chain of three weaknesses that together enable session fixation:</p> <p>### 1. Attacker-controlled session ID acceptance (`objects/functionsPHP.php:344-367`)</p> <p>```php function _session_start(array $options = []) { // ... if (isset($_GET[&#39;PHPSESSID&#39;]) &amp;&amp; !_empty($_GET[&#39;PHPSESSID&#39;])) { $PHPSESSID = $_GET[&#39;PHPSESSID&#39;]; // ... if (!User::isLogged()) { if ($PHPSESSID !== session_id()) { _session_write_close(); session_id($PHPSESSID); // &lt;-- sets session to attacker&#39;s ID } $session = @session_start($options); // &lt;-- starts with attacker&#39;s ID ```</p> <p>The code reads `$_GET[&#39;PHPSESSID&#39;]` and programmatically calls `session_id($PHPSESSID)`, which bypasses both `session.use_only_cookies` and `session.use_strict_mode` PHP settings since the session ID is set via the PHP API, not via cookie/URL handling.</p> <p>### 2. Session regeneration bypass for blacklisted e…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>AVideo&#39;s `_session_start()` function accepts arbitrary session IDs via the `PHPSESSID` GET parameter and sets them as the active PHP session. A session regeneration bypass exists for specific blacklisted endpoints when the request originates from the same domain. Combined with the explicitly disabled session regeneration in `User::login()`, this allows a classic session fixation attack where an attacker can fix a victim&#39;s session ID before authentication and then hijack the authenticated session.</p> <p>## Details</p> <p>The vulnerability is a chain of three weaknesses that together enable session fixation:</p> <p>### 1. Attacker-controlled session ID acceptance (`objects/functionsPHP.php:344-367`)</p> <p>```php function _session_start(array $options = []) { // ... if (isset($_GET[&#39;PHPSESSID&#39;]) &amp;&amp; !_empty($_GET[&#39;PHPSESSID&#39;])) { $PHPSESSID = $_GET[&#39;PHPSESSID&#39;]; // ... if (!User::isLogged()) { if ($PHPSESSID !== session_id()) { _session_write_close(); session_id($PHPSESSID); // &lt;-- sets session to attacker&#39;s ID } $session = @session_start($options); // &lt;-- starts with attacker&#39;s ID ```</p> <p>The code reads `$_GET[&#39;PHPSESSID&#39;]` and programmatically calls `session_id($PHPSESSID)`, which bypasses both `session.use_only_cookies` and `session.use_strict_mode` PHP settings since the session ID is set via the PHP API, not via cookie/URL handling.</p> <p>### 2. Session regeneration bypass for blacklisted e…</p> https://cve.radiocsirt.org/vuln/ghsa-x3pr-vrhq-vq43