CVE-2026-84482: WWBN AVideo Cross-Site Request Forgery via get_domain() validation
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Patch commit 9c39d8c8 - Compensating control
Use a compensating control to prevent cross-site request forgery: restrict administrative endpoints so requests must originate from trusted domains/subdomains (e.g., enforce origin/referer validation at the application edge/WAF and block sibling-subdomain forged requests).
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need privileges in AVideo, but must induce a user with administrative access to interact with a forged request. The forged request can originate from a sibling subdomain or an unparseable long-gTLD origin.
How can I determine whether my deployment is affected?
The issue is reported in WWBN AVideo through commit 9c39d8c8. Compare the source revision used by your deployment against that commit; no affected or fixed release versions are provided.