CVE-2026-62302High· 8.7▾ TwilightMyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in registration order, staticRoutes.ts and cloudRoutes.ts remain outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access local videos through /videos/*, thumbnails through /images/* and /images-small/*, avatars through /avatars/*, subtitles through /subtitles/*, cloud thumbnail caches through /api/cloud/thumbnail-cache/*, and cloud signed URLs or redirects through /cloud/videos/:filename and /cloud/images/:filename. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
MyTube < 1.10.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62301High· 7.1MyTube: Visitor Can Access Hidden Video Metadata and Content
CVE-2026-63434Medium· 4.3MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning
CVE-2026-63433Medium· 6.8MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
CVE-2025-61777Critical· 9.4Flag Forge is a Capture The Flag (CTF) platform
CVE-2025-14567Medium· 5.3A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0
CVE-2025-9815High· 7.8A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS