CVE-2026-33890: Franklioxygen Mytube Auth Bypass Flaw

CVE-2026-33890 Overview

CVE-2026-33890 is an authentication bypass vulnerability in MyTube, a self-hosted video downloader and player application. Prior to version 1.8.71, the application exposes passkey registration endpoints without requiring prior authentication. An unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials.

Critical Impact
Unauthenticated attackers can gain full administrative access to MyTube instances by registering arbitrary passkeys, leading to complete application compromise without any credentials.

Affected Products

Franklioxygen MyTube versions prior to 1.8.71

Discovery Timeline

2026-03-27 - CVE-2026-33890 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33890

Vulnerability Analysis

This vulnerability represents a critical improper access control flaw (CWE-284) in MyTube's passkey authentication system. The application's role-based authentication middleware incorrectly categorizes the passkey registration endpoint (/settings/passkeys/register) as a public path, allowing any unauthenticated user to access it. Once a passkey is registered through this unprotected endpoint, the application's authentication flow automatically grants administrator privileges to any authenticated passkey session.

The attack is particularly dangerous because it requires no prior knowledge of credentials, no user interaction, and can be executed remotely over the network. An attacker simply needs to discover an exposed MyTube instance and invoke the passkey registration endpoint to gain complete administrative control.

Root Cause

The root cause stems from a misconfiguration in the roleBasedAuthMiddleware.ts file where the passkey registration endpoint was incorrectly included in the PUBLIC_PREFIX_PATHS array. This design flaw meant that the endpoint bypassed all authentication checks, combined with a lack of authorization verification in the passkey registration controller itself. The authentication system then compounded this issue by automatically granting admin tokens to any authenticated passkey without verifying the legitimacy of the registration.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Discovering an exposed MyTube instance
Sending a registration request to the unprotected /settings/passkeys/register endpoint
Registering their own passkey without any authentication
Authenticating with the newly registered passkey
Receiving an administrator token and gaining full control of the application

The following code shows the security patch that addresses this vulnerability:

typescript

// Security patch in backend/src/controllers/passkeyController.ts
 import { setAuthCookie } from "../services/authService";
 import * as passkeyService from "../services/passkeyService";
 
+const requireAdminPasskeyRegistration = (
+  req: Request,
+  res: Response
+): boolean => {
+  if (req.user?.role === "admin") {
+    return true;
+  }
+
+  res.status(403).json({
+    success: false,
+    error: "Admin authentication required to register a passkey.",
+  });
+  return false;
+};
+
 /**
  * Get all passkeys
  * Errors are automatically handled by asyncHandler middleware

Source: GitHub Commit d6c1275

The middleware patch removes the registration endpoint from public paths:

typescript

// Security patch in backend/src/middleware/roleBasedAuthMiddleware.ts
 
 const PUBLIC_PREFIX_PATHS = [
   "/settings/passkeys/authenticate",
-  "/settings/passkeys/register",
 ] as const;
 
 const VISITOR_ALLOWED_POST_EXACT_PATHS = [

Source: GitHub Commit d6c1275

Detection Methods for CVE-2026-33890

Indicators of Compromise

Unexpected passkey registrations appearing in the application database or logs
Authentication events from newly created passkeys that were not registered by legitimate administrators
Sudden appearance of administrative sessions from unknown sources or IP addresses
Changes to application configuration or settings performed by unfamiliar admin accounts

Detection Strategies

Monitor web server logs for POST requests to /settings/passkeys/register endpoints, especially from unauthenticated sessions
Implement alerting on new passkey registrations when no administrative action was initiated
Review authentication logs for passkey-based logins that do not correlate with legitimate user activity
Deploy web application firewall rules to detect and block unauthorized access to passkey registration endpoints

Monitoring Recommendations

Enable verbose logging for all authentication and passkey-related operations in MyTube
Set up automated alerts for any new administrator account creation or passkey registration
Implement network monitoring to detect unusual traffic patterns to MyTube administrative endpoints
Regularly audit the list of registered passkeys and administrator sessions

How to Mitigate CVE-2026-33890

Immediate Actions Required

Upgrade MyTube to version 1.8.71 or later immediately
Audit all existing passkeys and remove any that were not legitimately created
Review administrator access logs for signs of unauthorized access
Rotate any sensitive credentials or API keys that may have been exposed

Patch Information

The vulnerability is fixed in MyTube version 1.8.71. The patch implements proper authentication checks in the passkey registration controller and removes the registration endpoint from the public paths whitelist. Users should upgrade to the patched version immediately. For detailed information about the fix, see the GitHub Security Advisory GHSA-378w-xh68-qrc8 and the patch commit.

Workarounds

Restrict network access to MyTube instances using firewall rules until patching is complete
Place MyTube behind a reverse proxy with additional authentication requirements
Temporarily disable passkey authentication if the feature is not actively required
Implement network-level access controls to limit who can reach the application

bash

# Configuration example - Restrict access via nginx reverse proxy
# Add to your nginx configuration for the MyTube site
location /settings/passkeys/register {
    deny all;
    return 403;
}

# Or restrict entire admin endpoints to specific IP ranges
location /settings/ {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
}