Threats Tagged 'cve-2026-33935'

CVE-2026-33935 affects franklioxygen MyTube versions prior to 1.8.72. It allows an unauthenticated attacker to cause a denial of service by locking out administrator and visitor accounts from password-based authentication. The vulnerability arises because three publicly accessible password verification endpoints share a single file-backed login attempt state, which tracks failed attempts and cooldown periods globally. An attacker can repeatedly trigger failed login attempts to progressively increase the lockout duration up to 24 hours, effectively preventing legitimate users from logging in. The lockout can be maintained indefinitely by continuing this pattern. Version 1.8.72 addresses this issue.