A session fixation vulnerability in WWBN AVideo versions 26.0 and earlier allows an attacker to hijack authenticated user sessions, posing a significant risk to account integrity.

The application fails to properly regenerate session identifiers within the _session_start function and the User::login method. This allows an attacker to supply a fixed session ID via the PHPSESSID GET parameter, which the application then trusts for the user session after authentication occurs.

Successful exploitation allows an attacker to take over active user sessions, including those belonging to administrative accounts. This results in unauthorized access to sensitive video content, user data, and platform configurations. With a CVSS score of 7.3, this high severity flaw represents a clear risk to the confidentiality and integrity of the platform.

Immediate Action: As no official release version containing the fix is currently listed, administrators should apply the patch manually from commit 5647a94d79bf69a972a86653fe02144079948785 in the official repository.

Proactive Monitoring: Monitor server access logs for anomalous PHPSESSID values appearing in GET requests, especially those that deviate from standard session management patterns.

Compensating Controls: Implement a Web Application Firewall rule to inspect and sanitize the PHPSESSID parameter, blocking requests that attempt to pass arbitrary or non-standard session strings.

Public Exploit Available: Unknown.

Given the potential for full session hijacking, organizations running WWBN AVideo must prioritize the application of the provided security patch. Until the patch is applied, restricting access to the application or implementing strict session timeout policies can help mitigate the risk of successful exploitation.