MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
Impact
MyTube versions prior to 1.10.3 have an unauthenticated media access vulnerability, allowing access to local videos, thumbnails, avatars, subtitles, and cloud storage without login. Unauthenticated clients can access these resources directly, bypassing the login wall.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
franklioxygen · GitHub_M
MyTube
1 range
franklioxygen · GitHub_M
MyTube
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.10.3
Other versions: unknown
Original source description
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in registration order, staticRoutes.ts and cloudRoutes.ts remain outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access local videos through /videos/*, thumbnails through /images/* and /images-small/*, avatars through /avatars/*, subtitles through /subtitles/*, cloud thumbnail caches through /api/cloud/thumbnail-cache/*, and cloud signed URLs or redirects through /cloud/videos/:filename and /cloud/images/:filename. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-62302View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-62302
Observed 2026-10-30T22:48:08.968Z · upstream updated 2026-10-30T22:15:09.861Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T21:26:44.630648Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "yes" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.