Executive brief
TubeBuddy is a popular Chrome extension for YouTube channel management. A vulnerability in version 5.8.4 allows an attacker to trick a user into visiting a malicious link that overwrites the extension's authentication token, causing the extension to send attacker-controlled credentials to TubeBuddy's backend servers. This can lead to unauthorized access to the user's YouTube channel, data corruption, or service disruption.
Technical details
The vulnerability is an insufficient data authenticity verification flaw (CWE-345) in the redirect URL handler within tubebuddymaster1.js. The content script executes on https://www.tubebuddy.com/redirect* and directly persists URL query parameters (t=token, c=channel_id, r=redirect_url) to Chrome's synced storage as tubebuddyToken-<channel_id> without validating token format, signature, origin, or state/nonce values. An attacker can craft a malicious redirect URL and socially engineer a victim to click it, causing arbitrary token injection. The extension then uses this corrupted token in subsequent requests to TubeBuddy backends. Attack vector is network-based and requires user interaction (clicking a link). The vulnerability is publicly disclosed with proof-of-concept code available.
Affected products
- BEN Group, Inc. TubeBuddy for YouTube 5.8.4
Timeline
- 2026-08-31: disclosed
- other: Public exploit/PoC available on GitHub