CVE-2026-84482: WWBN AVideo CSRF Vulnerability

CVE-2026-84482 Overview

CVE-2026-84482 is a cross-site request forgery (CSRF) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in the get_domain() and isSameDomain() functions, which fail to properly validate referer origins. Attackers can craft requests from sibling subdomains or unparseable long generic top-level domain (gTLD) origins to bypass the same-origin check. Successful exploitation enables administrative ObjectYPT writes, including live server configuration changes. The vulnerability is tracked under CWE-346: Origin Validation Error and affects WWBN AVideo through commit 9c39d8c8.

Critical Impact
An attacker who tricks an authenticated administrator into visiting a malicious page can forge requests that alter live server configuration in WWBN AVideo.

Affected Products

WWBN AVideo through commit 9c39d8c8
Deployments relying on get_domain() for referer validation
Deployments relying on isSameDomain() for referer validation

Discovery Timeline

2026-09-01 - CVE-2026-84482 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84482

Vulnerability Analysis

WWBN AVideo relies on referer-based origin validation to protect state-changing administrative endpoints. The get_domain() and isSameDomain() helpers parse the HTTP Referer header and compare the extracted host against the application's own domain. The parsing logic does not correctly handle sibling subdomains under a shared parent domain. It also mishandles origins whose hostnames use unparseable or unusually long gTLDs, producing false matches. When the comparison incorrectly returns true, protected write operations proceed as if the request originated from a trusted context. This weakness maps to CWE-346: Origin Validation Error.

Root Cause

The root cause is insufficient parsing and normalization of referer origins inside the two domain-validation helpers. The functions treat structurally different hostnames as equivalent when substring or suffix matching is used in place of strict host equality. Adjacent subdomains under the same parent domain and hostnames containing long gTLDs are the primary bypass classes documented in the advisory.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page on a sibling subdomain or on a domain that produces an unparseable long-gTLD origin. When an authenticated AVideo administrator visits that page, the attacker's page issues cross-origin requests to the AVideo instance. Because the referer check accepts the forged origin, the requests execute privileged ObjectYPT writes, including changes to live server configuration. No credentials or tokens are stolen; the attack abuses the victim's existing session.

See the GitHub Security Advisory GHSA-jm6j-xqvq-r8p5 and the VulnCheck Advisory on CSRF for reference material. No verified proof-of-concept code is published in the enriched data.

Detection Methods for CVE-2026-84482

Indicators of Compromise

Administrative ObjectYPT write requests whose Referer header points to a sibling subdomain of the AVideo host.
Requests to configuration endpoints with Referer values containing unusually long or malformed gTLDs.
Unexpected changes to live server configuration recorded in AVideo administrative audit logs.

Detection Strategies

Alert on state-changing requests to AVideo administrative endpoints where the Referer host differs from the canonical application host.
Correlate configuration-change events with the originating browser session, source IP, and referer to identify forged-origin patterns.
Baseline normal administrator referer patterns and flag deviations, particularly cross-subdomain referers.

Monitoring Recommendations

Enable verbose logging for AVideo administrative actions and forward logs to a centralized SIEM.
Monitor web server access logs for POST requests to ObjectYPT handlers with anomalous referer values.
Review outbound DNS and proxy telemetry for administrators visiting untrusted sites shortly before configuration changes occur.

How to Mitigate CVE-2026-84482

Immediate Actions Required

Update WWBN AVideo to a commit later than 9c39d8c8 that includes the fix referenced in GHSA-jm6j-xqvq-r8p5.
Restrict access to the AVideo administrative interface to trusted networks or VPN endpoints until the patch is applied.
Require administrators to use a dedicated browser profile for AVideo management to reduce cross-site attack surface.

Patch Information

Refer to the WWBN AVideo GitHub Security Advisory for the authoritative fix commit and upgrade guidance. The advisory identifies the vulnerable code as present through commit 9c39d8c8; deployments running that commit or earlier should upgrade to the patched revision.

Workarounds

Enforce strict host equality checks at a reverse proxy or web application firewall before requests reach AVideo administrative handlers.
Block or drop requests to administrative endpoints whose Referer header host does not exactly match the canonical AVideo hostname.
Require re-authentication for sensitive configuration changes to reduce the window in which a forged request can succeed.

bash

# Example nginx rule: reject admin writes with non-matching Referer host
location ~* /(objects|plugin)/ {
    if ($http_referer !~* "^https://avideo\.example\.com/") {
        return 403;
    }
    proxy_pass http://avideo_backend;
}