CVE-2026-33890

CRITICAL

9.8

Description

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/27/2026

Last Modified4/1/2026

Sourcenvd

Honeypot Sightings0

Affected Products

franklioxygen:mytube

Weaknesses (CWE)

CWE-284

References

https://github.com/franklioxygen/MyTube/commit/d6c1275a7ff7ffd3d51b53c333237f4d572580ac(security-advisories@github.com)

https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8(security-advisories@github.com)

https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.