Denial of Service in MyTube Video Downloader and Player

CVE-2026-33935

What is CVE-2026-33935?

MyTube, a self-hosted video downloader and player, suffers from a vulnerability that allows an unauthenticated attacker to lock out administrator and visitor accounts by triggering multiple failed login attempts. The application features three publicly accessible password verification endpoints that share a single login attempt state stored in a JSON file. When an invalid login is attempted, the shared counter for failed attempts is incremented, and a cooldown period is initiated. By exploiting this behavior, an attacker can systematically increase the lockout duration, leading to a denial of service for legitimate users. Once the lockout reaches its maximum duration of 24 hours, the attacker can continue this cycle, preventing users from authenticating for extended periods. This issue is resolved in version 1.8.72.

References