CVE-2026-84482

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8

Description Cross-site request forgery occurs because the get domain() and isSameDomain() functions fail to properly validate referer origins. This allows attackers to forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes, which can include changes to live server configurations.

Recommendations Update AVideo to a version including commit 9c39d8c8 or later. As a temporary mitigation, restrict access to administrative functions to minimize the risk of unauthorized configuration changes.