MyTube vulnerabilities
CVEs whose affected-version data names the MyTube package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-63434Medium· 4.3MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint han…
CVE-2026-63433Medium· 6.8MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the…
CVE-2026-62302High· 8.7MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMi…
CVE-2026-62301High· 7.1MyTube: Visitor Can Access Hidden Video Metadata and Content
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password …