Two vulnerabilities disclosed in AVideo including session hijacking and password hash oracle

Two security vulnerabilities have been disclosed in AVideo, a video platform. The first is a high severity session hijacking issue caused by unauthenticated session ID disclosure combined with permissive CORS settings (CVE-2026-33043).