PT-2026-28555 · Mytube · Mytube

Daniel-Grunbergerca · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-33890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.8.71

Description MyTube is a self-hosted downloader and player for several video websites. Before version 1.8.71, an unauthenticated attacker could register an arbitrary passkey and subsequently authenticate with it to obtain a full administrator session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. The vulnerable endpoints are the passkey registration endpoints. The passkey is the vulnerable parameter.

Recommendations Versions prior to 1.8.71 should be updated to version 1.8.71 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-33890

GHSA-378W-XH68-QRC8

Affected Products

Mytube

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33890.json · Exploit
• 🔥 https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8 · Exploit
• https://github.com/franklioxygen/MyTube/commit/d6c1275a7ff7ffd3d51b53c333237f4d572580ac · Patch
• https://osv.dev/vulnerability/CVE-2026-33890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33890 · Security Note
• https://twitter.com/CVEnew/status/2037513387505078717 · Twitter Post
• https://twitter.com/CVEarity/status/2037499427955613823 · Twitter Post