CVE-2026-82813: Insufficient Verification of Data Authenticity in BEN Group TubeBuddy for YouTube Extension

This vulnerability affects the TubeBuddy for YouTube Extension versions 5.8.0 through 5.8.4 on Chrome. The issue lies in the TBGlobal.GetToken function in the tubebuddymaster1.js file, where manipulation of the argument t/c/r leads to insufficient verification of data authenticity. This flaw allows remote exploitation without requiring privileges or user interaction, with limited impact on confidentiality and availability. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). The vendor has been contacted but no official fix or remediation level has been published. Exploit code is publicly available.

The vulnerability allows remote attackers to exploit insufficient data authenticity verification in the TubeBuddy extension, potentially leading to unauthorized actions or data manipulation within the extension context. The impact is rated medium with limited confidentiality and availability impact. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider disabling or removing the affected extension versions to mitigate risk.