CVE-2026-61995 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting YouTube Showcase versions up to and including 4.1.0. This flaw allows attackers to execute malicious scripts in the context of the affected application without requiring authentication.