MyTube CVE-2026-63434

Exploitation requires that the administrator has explicitly enabled BOTH the statisticsEnabled and statisticsTrackVisitorActivity settings (statisticsVisitorIngestionAllowed() must return true) - this is a non-default dual-toggle configuration. The attacker must additionally hold valid visitor-role credentials, i.e., knowledge of the shared visitor password, to obtain an authenticated session (PR:L); unauthenticated access does not reach the ingest path. Limiting factors that reduce real-world risk: impact is confined to integrity of administrator-visible statistics (no read of sensitive data, no RCE, no availability loss); the server-derived actorRole and surface fields cannot be forged through this issue; and the blast radius is largest only where visitor access is broadly shared (e.g., family or public read-only deployments), which lowers the effective privilege barrier.

This is a genuinely low-to-moderate priority integrity issue, not a high-impact emergency, and the signals agree on that. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that requires authentication (PR:L) and yields only limited integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) effect - consistent with the advisory, which scopes the damage to poisoned administrator-visible analytics (view counts, download counts, platform/source breakdowns, session metrics). No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The CVE is NOT on CISA KEV, and there is no indication of active exploitation. The vuln.today decision label is 'this_month' - a routine patch cadence, not act_now/emergency. A detailed public PoC reference exists in the GHSA-h5xx-g8fc-crr7 advisory (step-by-step curl requests) but it is not verified as packaged, standalone working exploit code. Note one labeling conflict: the input Tag is 'Information Disclosure,' yet both the CVSS vector (C:N, I:L) and the description describe data corruption/tampering, i.e., an integrity issue rather than disclosure - treat the 'Information Disclosure' framing as inaccurate. Bottom line: a real but bounded data-integrity bug against a self-hosted niche product, reasonably handled on a normal monthly patch schedule.

In a MyTube deployment where both statisticsEnabled and statisticsTrackVisitorActivity are turned on, an attacker who knows the shared visitor password logs in to obtain a valid visitor session, then repeatedly POSTs crafted event batches (up to 50 events each) to the /api/statistics/events ingest endpoint with attacker-chosen platform, sourceKind, and sessionId values. Because these fields are accepted from the client payload without server-side derivation or validation, the attacker inflates or fabricates platform attribution, view/download counts, and session analytics shown on the administrator dashboard. A public PoC reference (curl-based) exists in the GitHub security advisory; it is not verified as working standalone exploit code.