Read the docs
TI-2026-83345 Aliases CVE-2026-62302

MyTube: Unauthenticated Media Access via Static Routes Bypassing Login

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

MyTube, a self-hosted downloader and player for several video websites, before 1.10.3 mounts its static and cloud routes ahead of the authentication middleware, so they skip the login check even when loginEnabled is true. An unauthenticated remote attacker can fetch local videos, thumbnails, avatars, subtitles and cloud media through paths such as /videos/* and /cloud/videos/:filename (CWE-306). The frontend login wall does not block these direct media requests, and combined with hidden-video path leaks this allows unauthenticated download of hidden media.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed MyTube (franklioxygen): 1.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
franklioxygenMyTubebefore 1.10.31.10.3Patch availableCNA
  • MyTube Vendorfranklioxygen Affected before 1.10.3 Fixed in 1.10.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*——franklioxygen
  • cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:* Versions — — ·franklioxygen

Remediation

Update MyTube to version 1.10.3, which fixes the issue. The sources list no fixed version for other MyTube releases.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA MyTube (franklioxygen) Fixed in 1.10.3

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-62302
  2. 2026-10-30 CISA SSVC decision points changed

References

Other 3

  • TI-2026-26248 MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration CVSS 4.0HIGH 8.9
  • TI-2026-26114 MyTube has an Improper Access Control that Allows Complete Application Takeover CVSS 4.0HIGH 7.4
  • TI-2026-26286 MyTube has Unauthenticated Account Lockout via Shared Login Attempt State CVSS 4.0HIGH 7.7
  • TI-2026-84488 CSRF protection bypass in MyTube via arbitrary x-api-key header CVSS 3.1MEDIUM 6.8
  • TI-2026-83344 MyTube: Visitor Can Access Hidden Video Metadata and Content CVSS 4.0HIGH 7.1
  • TI-2026-19200 MyTube has an Authorization Bypass vulnerability CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences