Description

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T23:17:22.477Z",
  "pubdate": "2026-09-01T23:17:22.477Z",
  "executiveSummary": "WWBN AVideo, up to and including commit 9c39d8c8, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability stemming from inadequate origin validation.\nThe vulnerability resides within the get_domain() and isSameDomain() functions, which fail to sufficiently enforce integrity checks on the HTTP Referer header.\nAn unauthenticated or remote attacker can exploit this flaw to execute unauthorized requests, specifically targeting administrative ObjectYPT operations.\nSuccessful exploitation allows an attacker to perform sensitive configuration modifications, including live server setting changes, by inducing an authenticated administrative user to trigger a malicious request.\nThis vulnerability poses a significant risk to the integrity and availability of the AVideo platform, as it permits unauthorized state-changing operations under the context of an active administrative session.\nThere are no specific user interaction requirements beyond luring an authenticated administrator to a malicious or crafted origin that bypasses the flawed validation logic.",
  "technicalDetails": "The root cause of this vulnerability lies in the flawed implementation of origin-based access control within the get_domain() and isSameDomain() helper functions. These functions are intended to perform security checks by validating the source of incoming requests; however, they utilize logic that is insufficient to mitigate cross-origin attacks.\nSpecifically, the validation mechanism can be bypassed using sibling subdomains or by crafting requests with malformed, unparseable long-gTLD (generic Top-Level Domain) origins. Because the application trusts the Referer header without secondary validation mechanisms such as anti-CSRF tokens or strict origin allow-listing, it incorrectly identifies these forged requests as legitimate.\nThe attack flow proceeds as follows: 1) An attacker identifies a sensitive administrative endpoint within the ObjectYPT component of the AVideo installation that modifies server configuration. 2) The attacker crafts an HTTP request designed to invoke this administrative function. 3) The attacker hosts a malicious page on an origin that satisfies the vulnerable logic within isSameDomain(), such as a sibling subdomain. 4) The attacker lures an authenticated administrator to the malicious page. 5) The browser automatically attaches the administrator's session cookies to the crafted request. 6) The application's get_domain() function fails to invalidate the request, leading the backend to execute the configuration changes.\nThis vulnerability effectively grants an attacker the ability to perform administrative writes, enabling the alteration of critical server configurations. Given that the AVideo architecture relies on these functions for request verification, the exploit impact is extensive, potentially resulting in full administrative compromise or system instability via malicious configuration manipulation.\nThe vulnerability affects all versions of WWBN AVideo through commit 9c39d8c8. The lack of robust CSRF protection in administrative functions necessitates comprehensive remediation to ensure that state-changing requests are cryptographically bound to the session, rather than relying on easily spoofed header information."
}