← Vulnerability feed

Vulnerability record · CVE-2026-33890 · published 27 March 2026

CVE-2026-33890: Franklioxygen mytube improper access control vulnerability

FFranklioxygen · Mytube

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.

8.9 CVSS 4.0 High EPSS 0.70% · top 48.6% CWE-284 · Improper access control
8.9CVSS 4.0 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/franklioxygen/MyTube/commit/d6c1275a7ff7ffd3d51b53c333237f4d572580ac Patch
https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8 ExploitVendor Advisory
https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8 ExploitVendor Advisory

Track CVE-2026-33890 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-23837Franklioxygen mytube incorrect authorization vulnerabilityMyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions …EPSS 0.65%8.7CVE-2026-24139Franklioxygen mytube missing authorization vulnerabilityMyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, al…EPSS 0.36%7.7CVE-2026-33935Franklioxygen mytube improper restriction of authentication attempts vulnerabilityMyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administra…EPSS 0.80%7.4CVE-2026-33735Franklioxygen mytube improper authorization vulnerabilityMyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/impor…EPSS 0.59%5.3CVE-2026-24140Franklioxygen mytube mass assignment vulnerabilityMyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the setti…EPSS 0.33%5.3CVE-2026-23848Franklioxygen mytube vulnerabilityMyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` heade…EPSS 0.36%7.8CVE-2026-81963Windows Update Stack link-following privilege escalationWindows Update Stack resolves links improperly before accessing files, a link-following flaw (CWE-59) compounded by improper access control (CWE-284)…KEVEPSS 0.39%analysed10.0CVE-2026-21962Oracle HTTP Server and WebLogic Proxy Plug-in improper access controlOracle HTTP Server and the WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) contain an improper access control flaw (CWE-284) in suppor…KEVEPSS 71%analysed

Source: NIST National Vulnerability Database (record CVE-2026-33890), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.