CVE-2026-23837

CVE-2026-23837 is a critical authentication bypass vulnerability affecting MyTube versions 1.7.65 and potentially earlier, specifically when loginEnabled is true. Unauthenticated attackers can bypass the role-based authentication middleware by not providing an authentication cookie, gaining full access to sensitive API endpoints like /api/settings. This allows for unauthorized modification of application settings, including administrative and visitor passwords, leading to complete compromise of the MyTube instance. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high impact to confidentiality, integrity, and availability. The flaw is patched in MyTube v1.7.66, and users are urged to upgrade to at least v1.7.64 immediately. There is no evidence of active exploitation, nor are there public exploit modules available in Metasploit or Nuclei, or entries in ExploitDB. However, the vulnerability has garnered some community discussion, indicating awareness among security researchers.