Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-33890MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration
High 8.9
In plain English
A high-severity improper access control in MyTube from franklioxygen. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| franklioxygen | MyTube | < 1.8.71 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P