A video platform is vulnerable to session fixation. The platform’s session start routine accepts arbitrary session identifiers provided via the PHPSESSID GET parameter. Because the login process deliberately disables session regeneration, an attacker can predefine a victim’s session ID before the victim logs in and subsequently hijack the authenticated session. This enables the attacker to impersonate the user and access or manipulate the user’s data and actions. The weakness directly maps to a session fixation attack.

The affected vendor is WWBN, with its open‑source AVideo video platform. Versions up to and including 26.0 contain the flaw. No additional version sub‑sets are specified in the advisory.

The CVSS score is 7.3, indicating a high severity, while the EPSS score is below 1%, implying a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by delivering a crafted URL containing a desired PHPSESSID to a victim on the same domain. Since the application does not regenerate the session identifier after authentication, the attacker can reuse this identifier to obtain the victim’s authenticated session. The exploitation requires only a web browser interaction and does not need local code execution or privileged access.