I guess it's ECB, not CBC, because in CBC the same plaintext blocks would not generate the same ciphertext blocks.

"The "session" length seems a multiple of 32. Maybe they mean AES128"
32 bytes - is a block size, and both AES128 and AES256 has 32 bytes blocks. So it still can be AES256+ROT13.
And as Damian said, it was ECB, not CBC!

It was ECB (this is why you could do the forgery at all) and the block size of AES is always 16 bytes. The 128/192/256 version defines the length of the key not the block size.

Sorry, surely AES block size is always 16 bytes (128 bit), not 32 bytes.