Mytube CVE-2026-33890

MyTube versions prior to 1.8.71. Remote unauthenticated attacker registers arbitrary passkey via exposed unauthenticated endpoints, then authenticates with registered passkey to obtain admin session. No victim interaction required. Default configuration affected.

Although CVSS and EPSS scores are not provided, the risk is severe based on available signals. The attack vector is network-based, requires no authentication (PR:N equivalent), and exploits a fundamental design flaw in access control rather than a complex cryptographic bypass. No CVSS vector is supplied, preventing formal severity rating, but the combination of unauthenticated access, instant admin privilege grant, and complete application compromise indicates a critical-severity issue in practice. No KEV (CISA Known Exploited Vulnerability) status or public POC availability is documented in the input, suggesting no confirmed active exploitation at the time of public disclosure. However, the simplicity of exploitation-registering a passkey via an unauthenticated endpoint-makes this highly automatable and likely to be targeted quickly post-disclosure. The real-world priority is extreme for any self-hosted MyTube instance exposed to untrusted networks; air-gapped or strictly firewalled deployments face lower immediate risk but should still patch urgently.

An attacker discovers a self-hosted MyTube instance on the internet (e.g., via port scanning or subdomain enumeration). The attacker sends an HTTP POST request to the passkey registration endpoint with a crafted passkey payload. The unauthenticated endpoint accepts the registration without session validation, and the server automatically issues an admin token in response. The attacker uses this token in subsequent requests to download videos, modify settings, or access sensitive data-or escalates further by creating additional admin accounts or extracting backup credentials. No special tools or exploit code are required beyond standard HTTP clients, making this trivial to automate at scale.