What’s Vulnerable › Vulnerabilities

CVE-2026-33890: MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-27 · updated 2026-06-17
• Weakness: CWE-284

Description

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.

Affected products

• franklioxygen MyTube: before 1.8.71 — fixed in 1.8.71

How to fix

Upgrade to a fixed version: franklioxygen MyTube 1.8.71. Check the vendor advisory for mitigations.

References

• https://github.com/franklioxygen/MyTube/commit/d6c1275a7ff7ffd3d51b53c333237f4d572580ac
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8

Get alerted when CVE-2026-33890 or the next vulnerability affects your stack