CVE-2026-84482: Origin Validation Error in WWBN AVideo

CVE-2026-84482 describes a CSRF vulnerability in WWBN AVideo up to commit 9c39d8c8. The root cause is a failure in the get_domain() and isSameDomain() functions to correctly validate the referer origin, enabling attackers to bypass origin checks by using sibling subdomains or unparseable long generic top-level domain (gTLD) origins. Exploitation can lead to unauthorized administrative ObjectYPT writes, including changes to live server configurations. The CVSS 4.0 score is 8.7, indicating a high impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows remote attackers to perform unauthorized administrative actions on the AVideo server, including modifying live server configurations. This could compromise the integrity and availability of the service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published. Until a patch is available, administrators should be cautious about requests originating from sibling subdomains or unusual long-gTLD origins and consider additional protective measures such as CSRF tokens or stricter origin validation if possible.