Unprivileged users can obtain the current PHP session ID for any visitor by sending an unauthenticated request to /objects/phpsessionid.json.php. The endpoint echoes the requested Origin header in the Access‑Control‑Allow‑Origin response and sets Access‑Control‑Allow‑Credentials to true, which allows a malicious site to send credentials across origins. The combination of an exposed session identifier and permissive CORS lets an attacker hijack a session and impersonate the account that owns that session, resulting in a full compromise of user credentials.

The flaw exists in the WWBN AVideo platform in all releases up to and including version 25.0. Any deployment of these affected releases, regardless of hosting environment, is susceptible as long as the /objects/phpsessionid.json.php endpoint remains publicly reachable.

The CVSS score of 8.1 classifies this vulnerability as High severity. The EPSS rating of <1% indicates that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs network access to the server, can send an unauthenticated HTTP request to the vulnerable endpoint, and can supply a crafted Origin header to obtain the session token and subsequently use it to perform cross‑origin requests that authenticate as the victim.