EUVD-2026-68680
GHSA-qj7g-6829-fr6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible redirect handler, no attacker privileges needed, user must click crafted URL, token overwrite yields only integrity and availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
AnalysisAI
TubeBuddy for YouTube Chrome extension versions up to 5.8.4 by BEN Group exposes users to authentication token overwrite via an insufficiently verified redirect URL handler. The TBGlobal.GetToken function in tubebuddymaster1.js fails to validate the authenticity of data supplied through the t, c, and r URL parameters (CWE-345), enabling a remote attacker to overwrite the victim's stored authentication token. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must have TubeBuddy for YouTube extension version 5.8.4 or earlier installed and active in Google Chrome - the vulnerability exists in the extension's exposed redirect URL handler which is registered when the extension is loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 rates this Medium at 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P and exploit maturity E:P (PoC). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the available data - the input CPE bounds all versions up to 5.8.4 with no upper fix version specified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today