A critical cross-site request forgery vulnerability in WWBN AVideo allows unauthenticated attackers to perform unauthorized administrative configuration changes on affected systems.

The application fails to properly validate referer origins within the get_domain and isSameDomain functions. This allows an unauthenticated attacker to forge requests from malicious or malformed origins to execute administrative ObjectYPT writes.

The ability for an unauthenticated attacker to modify live server configurations presents a significant risk to system integrity and availability. Given the CVSS score of 8.8, this vulnerability is considered high severity, as it could lead to total service disruption, unauthorized data modification, or the hijacking of administrative functions.

Immediate Action: Review the official security advisory at the WWBN AVideo GitHub repository to identify the necessary commit or patch to resolve this origin validation error.

Proactive Monitoring: Monitor server access logs for suspicious administrative requests originating from unexpected referer headers or unusual subdomains.

Compensating Controls: Deploy a Web Application Firewall (WAF) to enforce strict referer header validation and block requests that do not originate from trusted, authorized domains.

Public Exploit Available: No

Due to the high severity of this vulnerability and the potential for complete administrative compromise, organizations using WWBN AVideo must prioritize securing their environments. Administrators should immediately audit their current commit level and apply any available vendor patches or mitigations to prevent unauthorized configuration changes.