CVE-2026-63434
MediumCVSS 4.3Summary
MyTube before 1.10.6, when statistics and visitor activity tracking are enabled, allows a visitor-role user to submit events to the statistics ingest endpoint. The server accepts client-controlled platform, sourceKind, and sessionId fields without validation, allowing fabricated events to corrupt administrator-visible view counts, download counts, and session analytics.
Risk Assessment
An attacker can falsify analytics and statistics visible to administrators, leading to incorrect decisions and distorted reports.
Recommendation
Update MyTube to version 1.10.6 or later.
Other vulnerabilities in MyTube
See all- CVE-2026-63433Medium
MyTube before 1.10.6 grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator into sending a cross-origin state-changing request that is authenticated by the session cookie while CSRF validation is skipped.
- CVE-2026-62302High
MyTube before 1.10.3 registers static and cloud routes before API routes, leaving them outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access videos, thumbnails, avatars, subtitles, and cloud signed URLs.
- CVE-2026-62301High
In MyTube prior to 1.10.3, the backend does not enforce the visitor role's public-only restriction when login is enabled and a visitor password is configured. The frontend filter is client-side only, and the middleware and video storage layer do not check the caller's role or visibility, so a visitor can enumerate and retrieve hidden videos along with their file paths.
Original NVD description (English source)
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS