# CVE-2026-33935: MyTube has Unauthenticated Account Lockout via Shared Login Attempt State > Unauthenticated attackers can lock out all users by triggering failed logins on shared endpoints, causing indefinite denial of service. - **Severity:** High 7.7 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 27 Mar 2026 - **Updated:** 27 Mar 2026 - **Also known as:** GHSA-6w95-qgc4-5jxf ## What is CVE-2026-33935? CVE-2026-33935 is a high-severity denial of service vulnerability in franklioxygen MyTube, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based authentication by triggering failed login attempts. The application exposes three password verification endpoints, all of which are publicly accessible. All three endpoints share a single file-backed login attempt state stored in `login-attempts.json`. When any endpoint records a failed authentication attempt via `recordFailedAttempt()`, the shared login attempt state is updated, increasing the `failedAttempts` counter and adjusting the associated timestamps and cooldown values. Before verifying a password, each endpoint calls `canAttemptLogin()`. This function checks the shared JSON file to determine whether a cooldown period is active. If the cooldown has not expired, the request is rejected before the password is validated. Because the failed attempt counter and cooldown timer are globally shared, failed authentication attempts against any endpoint affect all other endpoints. An attacker can exploit this by repeatedly sending invalid authentication requests to any of these endpoints, incrementing the shared counter and waiting for the cooldown period between attempts. By doing so, the attacker can progressively increase the lockout duration until it reaches 24 hours, effectively preventing legitimate users from authenticating. Once the maximum lockout is reached, the attacker can maintain the denial of service indefinitely by waiting for the cooldown to expire and sending another failed attempt, which immediately triggers another 24-hour lockout if no successful login occurred in the meantime. Version 1.8.72 fixes the vulnerability. Weakness: CWE-307 (Improper Restriction of Excessive Authentication Attempts) ## Which versions are affected by CVE-2026-33935? It affects 1 product. Products: Franklioxygen Mytube. ## How do I fix CVE-2026-33935? No fix has been published for CVE-2026-33935 yet. Limit exposure of the affected software until one is available. ## Is CVE-2026-33935 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33935 exists. ## Other vulnerabilities in franklioxygen MyTube - [CVE-2026-23837](https://insights.sbomify.com/CVE-2026-23837/): MyTube has an Authorization Bypass vulnerability (critical 9.8) - [CVE-2026-33890](https://insights.sbomify.com/CVE-2026-33890/): MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration (high 8.9) - [CVE-2026-24139](https://insights.sbomify.com/CVE-2026-24139/): MyTube Allows Unauthorized Database Export by Guest Users (high 8.7) - [CVE-2026-33735](https://insights.sbomify.com/CVE-2026-33735/): MyTube has an Improper Access Control that Allows Complete Application Takeover (high 7.4) - [CVE-2026-23848](https://insights.sbomify.com/CVE-2026-23848/): MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing (medium 6.5) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-33935 and fix it if it is affected. What it is: CVE-2026-33935 is a high-severity denial of service vulnerability in franklioxygen MyTube, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33935 exists. Affected product: franklioxygen MyTube. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-33935/ (Markdown: https://insights.sbomify.com/CVE-2026-33935/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-33935 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33935 - OSV: https://osv.dev/vulnerability/CVE-2026-33935 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-33935/ Summaries are generated and may contain mistakes; the official description above is the record.