EUVD-2026-64608
GHSA-hjhm-cmvf-w9vp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated GET request discloses cookie file; no integrity or availability impact; confidentiality limited to stored cookie data.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component.
AnalysisAI
Unauthenticated remote access to the cookies.txt file in MeTube (versions up to 2026.06.10) exposes yt-dlp session cookies via a direct HTTP request to the predictable path /download/.metube/cookies.txt. Any remote actor who can reach the MeTube instance can retrieve cookies potentially authenticating to YouTube or other streaming platforms, enabling session hijacking on those services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The MeTube instance must have a populated cookies.txt file at the default path /download/.metube/cookies.txt - this file is only present when the operator has configured yt-dlp cookie authentication (a deliberate, non-default setup step required for accessing restricted content). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.5 with VC:L correctly scopes impact to cookie data disclosure rather than full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single unauthenticated HTTP GET request to http://<metube-host>/download/.metube/cookies.txt and receives the plaintext Netscape-format cookies file in response. If the file contains valid YouTube or other streaming platform session tokens, the attacker imports them into a browser extension or yt-dlp instance and gains authenticated access to the victim's account. … |
| Remediation | Upgrade MeTube to version 2026.06.20 or later, which incorporates the fix introduced in commit ce897ee00903bf7ded406f0d7852d95dd4164add. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-425 – Direct Request ('Forced Browsing')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today