An unauthenticated attacker can trigger successive failed login attempts against any of the three publicly exposed password verification endpoints in MyTube, causing a globally shared lockout counter to reach its maximum value. The resulting 24‑hour lockout blocks all administrator and visitor accounts from using password‑based authentication. This leads to a denial of service that can be sustained indefinitely by repeating the attack pattern, without any successful login occurring to reset the lockout.

The vulnerability exists in the MyTube application from version 1.8.71 and earlier, as developed by franklioxygen. It affects all deployments of MyTube using the shared login attempt state mechanism, regardless of hosting environment, and can be exploited through any of the three publicly accessible login endpoints.

The issue carries a CVSS score of 7.7, indicating a high severity. The EPSS score is listed as below 1%, suggesting that widespread exploitation is currently unlikely, but the vulnerability is not included in the CISA KEV catalog. Attackers can perform the exploit without authentication by repeatedly sending invalid credentials to any endpoint, which is facilitated by the publicly exposed login routes. Once the lockout is triggered, the denial remains until the cooldown period expires or a successful login resets the counter.