Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-84482

WWBN AVideo Cross-Site Request Forgery via get_domain() validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WWBN AVideo

Default version status: unaffected

  • 0 to ≤ 9c39d8c8b4c1f75540788d6b391740852ceb0732affected

References