CVE-2026-84482: Php Origin Validation Fail Open Domain Comparisoncve-2026-84482-php-origin-validation-fail-open-domain-comparison
Same-site/origin decision is made by comparing two results of the same domain/host extraction helper ($F) without first rejecting parser failure. Such helpers return false/null/"" for hosts they cannot parse (long gTLDs, IPv6 literals, missing host), so two unrelated or attacker-chosen origins can satisfy "false === false" and the CSRF/Referer authenticity g
