MyTube Authentication and Authorization

MyTube versions prior to 1.8.71 allow unauthenticated remote attackers to register arbitrary passkeys and obtain full administrator access without any existing credentials. The vulnerability stems from exposed passkey registration endpoints that lack authentication checks and automatically grant admin tokens to any successfully registered passkey, enabling complete application compromise. Vendor-released patch version 1.8.71 addresses this flaw.

MyTube prior to version 1.8.72 permits unauthenticated attackers to trigger indefinite account lockouts affecting both administrator and visitor authentication by exploiting a shared, globally-scoped login attempt counter across three publicly accessible password verification endpoints. An attacker can repeatedly send invalid authentication requests to any endpoint, progressively increasing a 24-hour cooldown lockout duration that applies to all endpoints simultaneously, effectively denying legitimate users password-based authentication until the patch is deployed. No public exploit code or active in-the-wild exploitation has been confirmed, but the attack requires no privileges and can be automated trivially.

MyTube versions prior to 1.8.69 suffer from an authorization bypass in the `/api/settings/import-database` endpoint that allows low-privilege authenticated users to upload and replace the application's SQLite database entirely, resulting in complete application compromise. The vulnerability affects self-hosted instances of MyTube and extends to other POST routes using the same flawed authorization mechanism. No public exploit code or active exploitation has been confirmed at time of analysis, but the fix is available in version 1.8.69.