PT-2026-28555 · Mytube · Mytube

Daniel-Grunbergerca · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-33890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.8.71

Description MyTube is a self-hosted downloader and player for several video websites. Before version 1.8.71, an unauthenticated attacker could register an arbitrary passkey and subsequently authenticate with it to obtain a full administrator session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. The vulnerable endpoints are the passkey registration endpoints. The passkey is the vulnerable parameter.

Recommendations Versions prior to 1.8.71 should be updated to version 1.8.71 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-33890

GHSA-378W-XH68-QRC8

Produtos afetados

Mytube

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33890.json · Exploit
• 🔥 https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8 · Exploit
• https://github.com/franklioxygen/MyTube/commit/d6c1275a7ff7ffd3d51b53c333237f4d572580ac · Correção
• https://osv.dev/vulnerability/CVE-2026-33890 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037513387505078717 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2037499427955613823 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33890 · Nota de Segurança