MyTube vulnerabilities

MyTube before 1.10.6, when statistics and visitor activity tracking are enabled, allows a visitor-role user to submit events to the statistics ingest endpoint. The server accepts client-controlled platform, sourceKind, and sessionId fields without validation, allowing fabricated events to corrupt administrator-visible view counts, download counts, and session analytics.

MyTube before 1.10.6 grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator into sending a cross-origin state-changing request that is authenticated by the session cookie while CSRF validation is skipped.

MyTube before 1.10.3 registers static and cloud routes before API routes, leaving them outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access videos, thumbnails, avatars, subtitles, and cloud signed URLs.

In MyTube prior to 1.10.3, the backend does not enforce the visitor role's public-only restriction when login is enabled and a visitor password is configured. The frontend filter is client-side only, and the middleware and video storage layer do not check the caller's role or visibility, so a visitor can enumerate and retrieve hidden videos along with their file paths.