---
id: CVE-2026-63434
title: 'MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning'
summary: >-
  MyTube is a self-hosted downloader and player for several video websites.
  Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are
  enabled, a visitor-role user can submit events to the statistics ingest
  endpoint han…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-20
vendor: franklioxygen
product: MyTube
affected:
  - MyTube < 1.10.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T22:36:09.377087Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:39:55.937Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63434'
references:
  - url: >-
      https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7
    label: >-
      https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7
  - url: >-
      https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7
    label: >-
      https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7
  - url: >-
      https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66
    label: >-
      https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66
  - url: >-
      https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d
    label: >-
      https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d
  - url: 'https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6'
    label: 'https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6'
tags:
  - cve.org
epss: 0.00328
epssPercentile: 0.26031
ingestedAt: '2026-11-05T20:33:06.604Z'
---

## Overview

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.

## Affected

- `MyTube < 1.10.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.