CVE-2026-33890 is an access control flaw in MyTube, a self hosted video downloader and player. NVD scores it 9.8. Passkey registration needs no login, and any passkey that authenticates gets an admin token. Upgrade to 1.8.71. The advisory describes this as a complete compromise of the application without any existing credentials.
What's affected
NVD says versions before 1.8.71 are affected and 1.8.71 fixes it. The GitHub advisory lists versions up to 1.8.70 and shows no patched version, so rely on the NVD statement and the fix commit, and check the project's releases. The advisory names four passkey endpoints under /api/settings/passkeys/, two of which register a key without authentication.
How to check if you're exposed
Check the installed version and whether the app is reachable from outside your network. Look for passkeys in the settings that you did not add.
What to do now
- Upgrade to 1.8.71 or later.
- Keep MyTube behind a VPN or reverse proxy with authentication.
- Remove unknown passkeys and rotate stored credentials and cookies.
- Review downloads and settings for changes.
Why it matters
The record uses CWE-284, improper access control. Enrollment of a login method must require proof of identity. Otherwise the strong mechanism becomes a way in. The record is not marked as exploited in the wild and is not in CISA KEV.
The lesson applies to any app that adds passwordless login. Enrollment is the weakest moment, because the system has to decide who is allowed to add a login method. Require an existing authenticated session, or a one time setup flow tied to the first administrator, before any registration endpoint will respond. After you upgrade, test that registration endpoints return an authentication error when called without a session.
The record does not name a mitigation other than the upgrade, so plan for it. Until you can update, take the service off public networks and place it behind an authenticating proxy, since the weakness is in the app's own login setup and a proxy gives you a second gate.
Quick check
Does the attacker need credentials?
No. Registration endpoints were open without authentication.
Sources
Last reviewed: 19 October 2026.
