Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33890 MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and su… https://www.cve.org/CVERecord?id=CVE-2026-33890
Post summary
The text announces that MyTube versions before 1.8.71 allow unauthenticated attackers to register arbitrary passkeys, exposing a potential security flaw.
⚡ New CVE Alert: CVE-2026-33890 📊 Severity: 8.9 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33890 #CVE-2026-33890 #CVE #High #CyberSecurity #InfoSec https://t.co/iP0SuAhyvl
Post summary
The tweet announces a new high‑severity CVE (CVE-2026-33890) with limited details, serving primarily as a general alert rather than a deep technical or exploit discussion.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | franklioxygen | mytube | - | - | - |