MyTube prior to version 1.8.72 has an improper restriction of excessive authentication attempts (CWE-307). The application exposes three password verification endpoints that share a single file-based login attempt state stored in 'login-attempts.json'. Failed login attempts on any endpoint increment a shared counter and trigger cooldown periods that block further attempts before password verification. An attacker can exploit this by sending repeated invalid authentication requests to any endpoint, causing the shared failed attempt counter to increase and the cooldown period to extend progressively up to 24 hours. This results in a denial of service by locking out legitimate users from authenticating. The vulnerability is fixed in version 1.8.72.

An unauthenticated attacker can cause a denial of service by locking out all users from password-based authentication for up to 24 hours or indefinitely by maintaining the attack. This affects both administrator and visitor accounts, preventing legitimate access to the application until the cooldown expires or the lockout is reset. There is no indication of data compromise or privilege escalation, but the availability of authentication is impacted.

Upgrade MyTube to version 1.8.72 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed by the vendor's versioning information.