CVE-2026-63433
MediumCVSS 6.8Summary
MyTube before 1.10.6 grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator into sending a cross-origin state-changing request that is authenticated by the session cookie while CSRF validation is skipped.
Risk Assessment
An attacker can perform destructive administrator operations such as deleting media, triggering downloads, or changing subscriptions on behalf of a logged-in administrator.
Recommendation
Update MyTube to version 1.10.6 or later and restrict CORS_ALLOWED_ORIGINS to trusted origins.
Other vulnerabilities in MyTube
See all- CVE-2026-63434Medium
MyTube before 1.10.6, when statistics and visitor activity tracking are enabled, allows a visitor-role user to submit events to the statistics ingest endpoint. The server accepts client-controlled platform, sourceKind, and sessionId fields without validation, allowing fabricated events to corrupt administrator-visible view counts, download counts, and session analytics.
- CVE-2026-62302High
MyTube before 1.10.3 registers static and cloud routes before API routes, leaving them outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access videos, thumbnails, avatars, subtitles, and cloud signed URLs.
- CVE-2026-62301High
In MyTube prior to 1.10.3, the backend does not enforce the visitor role's public-only restriction when login is enabled and a visitor password is configured. The frontend filter is client-side only, and the middleware and video storage layer do not check the caller's role or visibility, so a visitor can enumerate and retrieve hidden videos along with their file paths.
Original NVD description (English source)
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS