The vulnerability allows an unauthenticated attacker to register an arbitrary passkey. The application exposes passkey registration endpoints without authentication. Once a passkey is registered the system issues an administrator token, thus giving the attacker full admin rights. This privileged escalation is a direct consequence of the CWE‑284 security flaw, where an actor gains unauthorized access to privileged resources.

The affected product is MyTube, a self‑hosted video downloader and player from franklioxygen. Versions prior to 1.8.71 are vulnerable; the issue was resolved in release 1.8.71. All earlier releases, including 1.8.70 and earlier, could be compromised through the described endpoint.

The CVSS base score of 8.9 classifies this as a high‑severity vulnerability. EPSS data is not available, and the exploit is not listed in the CISA KEV catalog. Attackers only need network access to the MyTube instance; no prior authentication is required. The exploit path is straightforward: contact the passkey registration endpoint, register any key, authenticate, and receive an admin session. Due to the lack of authentication checks, the risk of exploitation is high for exposed systems.