MyTube EUVD-2026-116195

Exploitation requires a specific, named misconfiguration: CORS_ALLOWED_ORIGINS must be set permissively (broadly or to '*') so the attacker's origin is allowed - this is not the default and is the primary limiting factor. Additionally, a victim who is an authenticated MyTube administrator with an active session cookie must be lured into visiting attacker-controlled content (the UI:R user-interaction requirement). No valid API key or prior authentication is needed by the attacker: the flaw in shouldSkipCsrfProtection()/isApiKeyRequest() grants the CSRF exemption on mere presence of an 'x-api-key' header or 'Authorization: ApiKey' value, so any arbitrary value (e.g. 'bogus') suffices to skip CSRF token validation while the victim's cookie authenticates the request. Properly restricted CORS origins eliminate the browser-delivered attack path.

This is a moderate, conditional risk rather than a drop-everything priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, base 6.8) tells a consistent story with the description: network-reachable and unauthenticated from the attacker's side (PR:N), but gated by two real-world frictions - AC:H reflecting the non-default permissive CORS_ALLOWED_ORIGINS requirement, and UI:R reflecting the need to lure a logged-in administrator to attacker-controlled content. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the conditional nature. There is no EPSS score, no CISA KEV listing, and no vendor/CISA claim of active exploitation in the supplied data, so there is no evidence of in-the-wild use; the GHSA advisory does include a concrete browser-based PoC, so working-grade exploitation is clearly plausible but the input does not mark the PoC as a confirmed working exploit. The main caveat to flag: exploitability hinges entirely on a permissive CORS configuration (broad or '*'), a setting that is attacker-independent and common in self-hosted deployments but NOT the shipped default, so raw CVSS severity overstates risk for well-configured instances and understates it for careless ones. No SSVC automatable/technical-impact decision fields were supplied to cross-check.

An administrator is logged into a self-hosted MyTube instance whose CORS_ALLOWED_ORIGINS has been set broadly (e.g. '*' or to include an attacker origin). The attacker lures that admin to a malicious page that issues a cross-origin DELETE/POST to the MyTube API carrying a bogus 'x-api-key' header and the victim's session cookie; because CSRF is skipped merely on header presence, the server executes the state-changing call. A detailed proof-of-concept HTML page is published in the GHSA advisory, though the input does not confirm it as verified working exploit code.