Mytube
CVE-2026-23837
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend request without authentication cookie
-
ExploitBypass roleBasedAuthMiddleware check
-
ExecutionAccess /api/settings endpoint
-
ImpactModify admin passwords and application settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | MyTube version 1.7.65 or earlier with loginEnabled: true configuration. Attacker sends HTTP request without authentication cookie to trigger undefined req.user state, bypassing middleware authentication validation. |
| Impact | CVSS 9.8 with patch available. Self-hosted media applications often run on home servers with access to local networks, making this a potential pivot point. |
| Exploit ScenarioDerived | An attacker discovers a publicly exposed MyTube instance, accesses admin endpoints without authentication to view stored content, modify configurations, or use the server as a proxy for further attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
MyTube self-hosted video downloader has an authorization bypass (CVSS 9.8) that allows unauthenticated access to administrative functions in versions 1.7.65 and prior.
Earlier versions of this analysis (1)
Authorization bypass in MyTube video downloader exposes admin functions without authentication.
RemediationAI
Update MyTube to the patched version. Ensure the application is not publicly accessible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MyTube version 1.7.65 has a CWE-863 incorrect authorization vulnerability that allows unauthenticated users to access administrative endpoints, potentially including server configuration and stored content.
Know when Mytube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next().
Executive ViewAI
Organizations using version 1.7.65 and poetntially earlier face critical risk from CVE-2026-23837, a incorrect authorization vulnerability rated CVSS 9.8. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Mytube versions up to 1.7.71 contains a vulnerability that allows attackers to bypass IP-based rate limiting on general
MyTube versions prior to 1.8.71 allow unauthenticated remote attackers to register arbitrary passkeys and obtain full ad
MyTube deployments running in multi-user mode (loginEnabled=true) expose all locally stored and cloud-proxied media - vi
MyTube prior to version 1.8.72 permits unauthenticated attackers to trigger indefinite account lockouts affecting both a
MyTube versions prior to 1.8.69 suffer from an authorization bypass in the `/api/settings/import-database` endpoint that
MyTube through 1.10.2, when deployed in multi-user mode with loginEnabled=true and a visitor password configured, lets a
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignme
MyTube versions 1.7.78 and earlier allow authenticated users to bypass authorization controls and export the complete ap
Exploit-DB