Mytube
CVE-2026-24140
LOW
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | CVSS 2.7 (LOW). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: None. Exploitation no authentication required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized propertie...
Earlier versions of this analysis (1)
Mytube is affected by improperly controlled modification of dynamically-determined object attributes (CVSS 2.7).
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 1.7.78.. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) exists in the settings management component. MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties.
Know when Mytube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.
Executive ViewAI
CVE-2026-24140 is a low-severity vulnerability in MyTube (CVSS 2.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Affected Products (CPE)GitHub Advisory
Mytube versions up to 1.7.71 contains a vulnerability that allows attackers to bypass IP-based rate limiting on general
MyTube self-hosted video downloader has an authorization bypass (CVSS 9.8) that allows unauthenticated access to adminis
MyTube versions prior to 1.8.71 allow unauthenticated remote attackers to register arbitrary passkeys and obtain full ad
MyTube deployments running in multi-user mode (loginEnabled=true) expose all locally stored and cloud-proxied media - vi
MyTube prior to version 1.8.72 permits unauthenticated attackers to trigger indefinite account lockouts affecting both a
MyTube versions prior to 1.8.69 suffer from an authorization bypass in the `/api/settings/import-database` endpoint that
MyTube through 1.10.2, when deployed in multi-user mode with loginEnabled=true and a visitor password configured, lets a
MyTube versions 1.7.78 and earlier allow authenticated users to bypass authorization controls and export the complete ap
Exploit-DB