MyTube’s authentication layer exposes three independent password‑verification endpoints that all rely on a single shared file to track login attempts. When any endpoint records a failed login, it increments a global counter and starts a cooldown period. Because the same counter and timer are consulted by every endpoint before accepting a password, an unauthenticated attacker can send repeated bad credentials to any of these endpoints and progressively raise the lockout duration. The attacker may then cycle the cooldown to maintain a 24‑hour lockout for all users, effectively denying legitimate administrators and visitors from logging in. This vulnerability falls under Weak Authentication (CWE‑307) and results in a denial of service for all accounts.

The flaw affects Franklioxygen’s MyTube product up to and including version 1.8.71. The vulnerable behavior is present in all publicly accessible password‑verification endpoints of the backend service. A fix was introduced in release 1.8.72, which removes the shared login‑attempt state and resets the counter per endpoint.

The CVSS base score of 7.7 indicates high availability impact and requires no privileged access, making the threat moderate but significant. No data is available on exploit probability, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited evidence of widespread exploitation. However, the attack path is straightforward: an unauthenticated user can abuse any of the three endpoints via simple HTTP requests to a publicly reachable MyTube instance to trigger and maintain the lockout.