MyTube EUVD-2026-114369

Exploitation requires the instance to be deployed in multi-user mode with loginEnabled=true (admin/visitor passwords configured); in that mode the static routes (registerStaticRoutes) and cloud proxy routes (registerCloudRoutes) are registered in server.ts before registerApiRoutes, so the authMiddleware/roleBasedAuthMiddleware stack never applies to /videos/*, /images/*, /images-small/*, /avatars/*, /subtitles/*, /api/cloud/thumbnail-cache/*, /cloud/videos/:filename, and /cloud/images/:filename. No credentials, cookie, token, or user interaction are needed to fetch these. LIMITING FACTORS: the default loginEnabled=false single-user deployment is NOT affected (no auth boundary exists to bypass); cloud routes return 404 when cloud storage is unconfigured (a route-handler response, not an auth rejection); and downloading specific hidden media additionally depends on knowing or leaking the file path (the separate hidden-video path leak).

Severity signals are moderately strong but conditional. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, and the confidentiality-only impact (VC:H, VI:N, VA:N, no scope change to other systems) matches CWE-306 (Missing Authentication): the real-world effect is unauthorized disclosure of media, not code execution or tampering. The vuln.today decision label is 'this_week' (not act_now/emergency). No CISA KEV entry is present in the input and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - the status is 'no public exploit identified as actively exploited'; however, the GHSA advisory itself contains a working curl-based PoC, so the barrier to abuse is effectively zero for anyone who reads it. The dominant caveat is configuration dependence: the flaw ONLY matters when loginEnabled=true (multi-user mode with admin/visitor passwords). The default deployment (loginEnabled=false, single-user) has no authentication boundary to bypass and is therefore not affected. So although the raw vector reads as a textbook 8.7 unauthenticated network issue, real priority is bounded by (a) how many instances run in multi-user mode and (b) the small deployment footprint of this self-hosted hobby project. No SSVC automatable/technical-impact decision data was provided to further weigh this. Net: a genuine, trivially exploitable authentication-bypass for multi-user instances, but scoped to confidentiality of media and gated by a non-default configuration.

An attacker who can reach a MyTube instance running in multi-user mode (loginEnabled=true) requests media paths such as /videos/private.mp4, /subtitles/private.vtt, /images/* or /cloud/videos/:filename directly, with no cookie or token, and receives the content despite the frontend login wall. A working PoC (curl commands) is published in the GHSA advisory; combined with hidden-video path leaks, the attacker can enumerate and download private or hidden media without ever authenticating.