Executive brief
WWBN AVideo is a video platform and content management system. A flaw in its domain validation functions allows attackers to forge requests from sibling subdomains or sites with complex top-level domains, bypassing CSRF protections and enabling unauthorized administrative changes to live server configurations and other critical settings.
Technical details
The vulnerability is a cross-site request forgery (CSRF) caused by broken origin validation in the get_domain() and isSameDomain() functions. The get_domain() regex collapses sibling subdomains (e.g., evil.mysite.com and videos.mysite.com) to a common parent, and returns false for unparseable hosts including long gTLDs. The isSameDomain() comparison treats false === false as true, incorrectly treating unparseable origins as same-domain. This gate protects state-changing JSON endpoints used for administrative ObjectYPT writes (ObjectYPT::save() and delete()). An attacker can inject forged requests via sibling subdomains or long-gTLD origins that the victim's session will execute. The prerequisite is an active administrator session; for sibling-subdomain attacks, the attacker must control a subdomain under the same parent; for long-gTLD attacks, cookies must reach the request (which occurs on HTTPS due to a SameSite=None configuration). No patch has been released as of the advisory date.
Affected products
- WWBN AVideo through commit 9c39d8c8
Timeline
- 2026-09-01: disclosed
- 2026-08-18: advisory: GitHub security advisory GHSA-jm6j-xqvq-r8p5 published