CVE-2026-84482

WWBN AVideo, an open-source self-hosted video platform, contains an origin validation error (CWE-346) in its get_domain() and isSameDomain() functions, which rely on referer headers that are not properly validated. An attacker can trigger the flaw by getting a logged-in AVideo administrator to load an attacker-controlled page from a sibling subdomain of the video server, or from an origin on a long or unusual gTLD that the domain parser fails to reject. Because these malformed or related origins pass the same-domain check, forged cross-site requests are accepted and executed with administrative privileges, allowing unauthorized ObjectYPT writes, including changes to live server configuration. Any operator running a self-hosted AVideo instance through commit 9c39d8c8 is affected, particularly where admin browsers are logged in while browsing other sites on sibling subdomains. Exploitation has not been observed: no public proof-of-concept is known, the EPSS score is just 0.1% (3rd percentile), and the flaw is not in CISA's KEV catalog.

What to do: Operators should upgrade to a WWBN AVideo release or commit newer than 9c39d8c8 once a fix is published, and until then avoid browsing untrusted sites from a browser logged into the AVideo admin panel. Restrict the admin interface to trusted networks or VPN access, review live server configuration settings for unexpected changes, and watch the WWBN/AVudio repository for the patched commit addressing the referer validation in get_domain() and isSameDomain().