CVE-2026-84482 - WWBN AVideo Cross-Site Request Forgery
CVE-2026-84482 - WWBN AVideo Cross-Site Request Forgery
CVE-2026-84482, rated with a high CVSS 3.1 score of 8.8, affects WWBN AVideo and is identified as a Cross-Site Request Forgery via get_domain() validation. 🚨
WWBN AVideo, specifically through commit 9c39d8c8, contains a cross-site request forgery vulnerability within its get_domain() and isSameDomain() functions. These functions are flawed as they fail to adequately validate referer origins. This vulnerability enables attackers to craft malicious requests from sibling subdomains or from unparseable long-gTLD origins, potentially leading to unauthorized administrative ObjectYPT writes, including live server configuration changes.
The vulnerability was published on September 1, 2026, at 11:17 p.m. and was last modified on the same date and time. It is confirmed to be remotely exploitable. The disclosure originated from vulncheck.com.
The affected product is WWBN AVideo, with one vendor and one product identified as affected by this vulnerability. For CVE-2026-84482, CVSS 3.1 scores indicate a HIGH severity rating of 8.8. Data from disclosure@vulncheck.com specifies an Exploitability Score of 2.8 and an Impact Score of 5.9. Additionally, CVSS 4.0 scores also rate the vulnerability as HIGH severity, with a score of 8.7. CVE-2026-84482 is specifically associated with CWE-346: Origin Validation Error.
To mitigate this cross-site request forgery vulnerability stemming from issues in domain validation functions, AVideo requires an update. The recommended solution includes updating AVideo to commit 9c39d8c8 or a later version, ensuring that referer origins are strictly validated, and implementing the SameSite cookie attribute.
The Common Attack Pattern Enumeration and Classification (CAPEC) serves as a repository for attack patterns. These patterns describe the common attributes and methodologies employed by adversaries to exploit weaknesses, such as those found in CVE-2026-84482. Associated CAPEC patterns include:
- Exploitation of Trusted Identifiers (CAPEC-21)
- Session Credential Falsification through Prediction (CAPEC-59)
- Reusing Session IDs (aka Session Replay) (CAPEC-60)
- Manipulating Writeable Configuration Files (CAPEC-75)
- Manipulating Web Input to File System Calls (CAPEC-76)
- Pharming (CAPEC-89)
- JSON Hijacking (aka JavaScript Hijacking) (CAPEC-111)
- Cache Poisoning (CAPEC-141)
- DNS Cache Poisoning (CAPEC-142)
- Exploit Script-Based APIs (CAPEC-160)