CVE-2026-84482
Received Received - Intake

CSRF in AVideo Leading to Admin ObjectYPT Write

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84482
EUVD
EUVD-2026-69724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) in WWBN AVideo. It exists in the get_domain() and isSameDomain() functions which do not properly validate referer origins. Attackers can exploit this by forging requests from sibling subdomains or unparseable long-gTLD origins to perform unauthorized administrative writes, including changes to live server configurations.

Impact Analysis

An attacker could exploit this to perform unauthorized administrative actions such as modifying server configurations. This could lead to data breaches, unauthorized access to sensitive data, or disruption of services. Users with administrative privileges are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage for organizations handling sensitive data.

Mitigation Strategies

Update WWBN AVideo to the latest commit or version to patch the CSRF vulnerability in get_domain() and isSameDomain() functions. Implement strict referer header validation for administrative actions. Consider disabling live server configuration changes until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84482. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart