Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82813BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity

Medium 5.4

In plain English

A medium-severity insufficient verification of data authenticity in TubeBuddy for YouTube Extension from BEN Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 87.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Affected products (as reported)

VendorProductVersions
BEN Group TubeBuddy for YouTube Extension 5.8.05.8.15.8.25.8.35.8.4

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References