CVE-2026-33935

CVE-2026-33935 impacts MyTube versions prior to 1.8.72, allowing an unauthenticated attacker to cause a Denial of Service (DoS) by locking out legitimate users from password-based authentication. This vulnerability arises from a globally shared login attempt state across multiple public endpoints, enabling an attacker to repeatedly send invalid requests and progressively increase lockout durations up to 24 hours, which can be maintained indefinitely. Rated with a CVSSv4 score of 7.7 (High), the attack vector is network-based with low complexity, requiring no privileges or user interaction, and resulting in a high impact on availability. Although the method for exploitation is straightforward, there is currently no evidence of active exploitation, public exploit code, or significant community discussion, and its EPSS score is very low.