CVE-2026-33890: Franklioxygen Mytube Auth Bypass Flaw

CVE-2026-33890 Overview

CVE-2026-33890 is an authentication bypass vulnerability in MyTube, a self-hosted video downloader and player application. Prior to version 1.8.71, the application exposes passkey registration endpoints without requiring prior authentication. An unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials.

Critical Impact

Unauthenticated attackers can gain full administrative access to MyTube instances by registering arbitrary passkeys, leading to complete application compromise without any credentials.

Affected Products

• Franklioxygen MyTube versions prior to 1.8.71

Discovery Timeline

• 2026-03-27 - CVE-2026-33890 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33890

Vulnerability Analysis

This vulnerability represents a critical improper access control flaw (CWE-284) in MyTube's passkey authentication system. The application's role-based authentication middleware incorrectly categorizes the passkey registration endpoint (/settings/passkeys/register) as a public path, allowing any unauthenticated user to access it. Once a passkey is registered through this unprotected endpoint, the application's authentication flow automatically grants administrator privileges to any authenticated passkey session.

The attack is particularly dangerous because it requires no prior knowledge of credentials, no user interaction, and can be executed remotely over the network. An attacker simply needs to discover an exposed MyTube instance and invoke the passkey registration endpoint to gain complete administrative control.

Root Cause

The root cause stems from a misconfiguration in the roleBasedAuthMiddleware.ts file where the passkey registration endpoint was incorrectly included in the PUBLIC_PREFIX_PATHS array. This design flaw meant that the endpoint bypassed all authentication checks, combined with a lack of authorization verification in the passkey registration controller itself. The authentication system then compounded this issue by automatically granting admin tokens to any authenticated passkey without verifying the legitimacy of the registration.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Discovering an exposed MyTube instance
2. Sending a registration request to the unprotected /settings/passkeys/register endpoint
3. Registering their own passkey without any authentication
4. Authenticating with the newly registered passkey
5. Receiving an administrator token and gaining full control of the application

The following code shows the security patch that addresses this vulnerability:

// Security patch in backend/src/controllers/passkeyController.ts
 import { setAuthCookie } from "../services/authService";
 import * as passkeyService from "../services/passkeyService";
 
+const requireAdminPasskeyRegistration = (
+  req: Request,
+  res: Response
+): boolean => {
+  if (req.user?.role === "admin") {
+    return true;
+  }
+
+  res.status(403).json({
+    success: false,
+    error: "Admin authentication required to register a passkey.",
+  });
+  return false;
+};
+
 /**
  * Get all passkeys
  * Errors are automatically handled by asyncHandler middleware

Source: GitHub Commit d6c1275

The middleware patch removes the registration endpoint from public paths:

// Security patch in backend/src/middleware/roleBasedAuthMiddleware.ts
 
 const PUBLIC_PREFIX_PATHS = [
   "/settings/passkeys/authenticate",
-  "/settings/passkeys/register",
 ] as const;
 
 const VISITOR_ALLOWED_POST_EXACT_PATHS = [

Source: GitHub Commit d6c1275

Detection Methods for CVE-2026-33890

Indicators of Compromise

• Unexpected passkey registrations appearing in the application database or logs
• Authentication events from newly created passkeys that were not registered by legitimate administrators
• Sudden appearance of administrative sessions from unknown sources or IP addresses
• Changes to application configuration or settings performed by unfamiliar admin accounts

Detection Strategies

• Monitor web server logs for POST requests to /settings/passkeys/register endpoints, especially from unauthenticated sessions
• Implement alerting on new passkey registrations when no administrative action was initiated
• Review authentication logs for passkey-based logins that do not correlate with legitimate user activity
• Deploy web application firewall rules to detect and block unauthorized access to passkey registration endpoints

Monitoring Recommendations

• Enable verbose logging for all authentication and passkey-related operations in MyTube
• Set up automated alerts for any new administrator account creation or passkey registration
• Implement network monitoring to detect unusual traffic patterns to MyTube administrative endpoints
• Regularly audit the list of registered passkeys and administrator sessions

How to Mitigate CVE-2026-33890

Immediate Actions Required

• Upgrade MyTube to version 1.8.71 or later immediately
• Audit all existing passkeys and remove any that were not legitimately created
• Review administrator access logs for signs of unauthorized access
• Rotate any sensitive credentials or API keys that may have been exposed

Patch Information

The vulnerability is fixed in MyTube version 1.8.71. The patch implements proper authentication checks in the passkey registration controller and removes the registration endpoint from the public paths whitelist. Users should upgrade to the patched version immediately. For detailed information about the fix, see the GitHub Security Advisory GHSA-378w-xh68-qrc8 and the patch commit.

Workarounds

• Restrict network access to MyTube instances using firewall rules until patching is complete
• Place MyTube behind a reverse proxy with additional authentication requirements
• Temporarily disable passkey authentication if the feature is not actively required
• Implement network-level access controls to limit who can reach the application

# Configuration example - Restrict access via nginx reverse proxy
# Add to your nginx configuration for the MyTube site
location /settings/passkeys/register {
    deny all;
    return 403;
}

# Or restrict entire admin endpoints to specific IP ranges
location /settings/ {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
}