🚨 CVE-2026-84482
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
🎖@cveNotify
GitHub
CSRF: broken `get_domain()` / `isSameDomain()` collapses Referer authenticity so sibling-subdomain and long-gTLD origins pass admin…
## Summary
`get_domain()` in `objects/functions.php:2539-2555` extracts a "registrable" host with the regex `(?P<domain>[a-z0-9][a-z0-9\-]{1,63}\.[a-z\.]{2,6})$`. That pattern both...
September 1, 2026 19
