WWBN AVideo CVE-2026-84482

Exploitation requires all of the following: (1) the victim has an active authenticated AVideo administrator session in their browser at the time of attack; (2) the attacker controls a sibling subdomain sharing the same registrable domain as the AVideo instance (e.g., any *.example.com host if AVideo is at avideo.example.com) OR can craft a URL with a long or unparseable gTLD that causes isSameDomain() to default-allow the origin; and (3) the administrator is induced to load attacker-controlled content in the same browser session (UI:P - passive user interaction). Deployments that isolate the admin interface behind a VPN, internal IP allowlist, or separate authentication layer significantly reduce exploitability by limiting the attacker's ability to serve a forged-request page that reaches the admin endpoint. CSRF cannot read response data due to the same-origin policy, so the attack is limited to state-changing writes and cannot directly exfiltrate server responses.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) correctly captures that no attacker privileges are needed and the attack is network-reachable, but VC:H is likely overstated for pure CSRF - the same-origin policy prevents the attacker from reading the forged request's response, meaning confidentiality impact is indirect at best. The dominant real-world risk is integrity (live server configuration can be overwritten) and availability (misconfiguration-induced service disruption). The CVE is not in CISA KEV and no POC has been published, so exploitation remains theoretical, though the attack mechanics are well-understood CSRF techniques requiring no specialized tooling. Even a mid-sized self-hosted media deployment in olsztyn should treat this as urgent, given that successful exploitation hands an attacker admin-level configuration writes without needing any credentials. EPSS score is absent from available intelligence; absence of exploit evidence should not be read as low risk given the low attack complexity.

An attacker registers a sibling subdomain (e.g., attacker.example.com) of the target AVideo deployment (avideo.example.com) and hosts a page with a hidden form that submits a forged POST to the AVideo admin ObjectYPT endpoint. When a logged-in administrator visits the attacker's page - via phishing email or injected link - the browser sends the request with the sibling referer, which get_domain() resolves to the same parent domain and accepts as valid. The attacker's payload silently overwrites live server configuration, potentially disabling authentication or redirecting media streams.