Read the docs
TI-2026-84488 Aliases CVE-2026-63433

CSRF protection bypass in MyTube via arbitrary x-api-key header

Priority HIGH 65CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Tampering
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

MyTube before 1.10.6 skips CSRF checks for any request carrying an x-api-key header or Authorization ApiKey value, without validating the key (CWE-352). With a permissive CORS_ALLOWED_ORIGINS setting, an unauthenticated attacker can lure an authenticated administrator to a page that sends a forged cross-origin request. The administrator's session cookie authenticates it, letting the attacker delete media, trigger downloads or change subscriptions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0013 2nd percentileScored 2026-11-07
Fix Fixed MyTube (franklioxygen): 1.10.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
franklioxygenMyTubebefore 1.10.61.10.6Patch availableCNA
  • MyTube Vendorfranklioxygen Affected before 1.10.6 Fixed in 1.10.6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*——franklioxygen
  • cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:* Versions — — ·franklioxygen

Remediation

Upgrade MyTube to version 1.10.6, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA MyTube (franklioxygen) Fixed in 1.10.6

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63433
  2. 2026-11-05 Priority changed: MEDIUM → LOW
  3. 2026-11-07 CISA SSVC decision points changed
  4. 2026-11-07 Priority changed: LOW → HIGH

References

Other 2

  • TI-2026-26248 MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration CVSS 4.0HIGH 8.9
  • TI-2026-26114 MyTube has an Improper Access Control that Allows Complete Application Takeover CVSS 4.0HIGH 7.4
  • TI-2026-26286 MyTube has Unauthenticated Account Lockout via Shared Login Attempt State CVSS 4.0HIGH 7.7
  • TI-2026-83344 MyTube: Visitor Can Access Hidden Video Metadata and Content CVSS 4.0HIGH 7.1
  • TI-2026-19200 MyTube has an Authorization Bypass vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-83345 MyTube: Unauthenticated Media Access via Static Routes Bypassing Login CVSS 4.0HIGH 8.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences