Franklioxygen
Monthly
MyTube deployments running in multi-user mode (loginEnabled=true) expose all locally stored and cloud-proxied media - videos, thumbnails, small thumbnails, avatars, subtitles and cloud signed URLs - to unauthenticated clients because the static and cloud route handlers are mounted before the authentication middleware. An attacker with network reach to the instance can fetch `/videos/*`, `/images/*`, `/subtitles/*`, `/avatars/*`, `/api/cloud/thumbnail-cache/*` and `/cloud/videos|images/:filename` without any session cookie, token or user interaction, and can combine this with the separate hidden-video path leak to download media the operator intended to hide. The default single-user configuration (loginEnabled=false) has no authentication boundary and is not affected; the flaw is fixed in version 1.10.3, a public PoC reference (curl-based request examples) is documented in the advisory, and there is no indication of confirmed active exploitation (no CISA KEV listing).
MyTube through 1.10.2, when deployed in multi-user mode with loginEnabled=true and a visitor password configured, lets an authenticated visitor retrieve hidden (visibility=0) video records and then download the associated media and subtitles because the backend video queries and static media routes do not enforce the visitor's intended public-only role restriction. The GitHub security advisory includes a public proof-of-concept request sequence; it is not independently verified as working exploit code, and no CISA KEV entry or confirmed active exploitation was reported. Deployments using the default loginEnabled=false single-user mode are unaffected.
MyTube prior to version 1.8.72 permits unauthenticated attackers to trigger indefinite account lockouts affecting both administrator and visitor authentication by exploiting a shared, globally-scoped login attempt counter across three publicly accessible password verification endpoints. An attacker can repeatedly send invalid authentication requests to any endpoint, progressively increasing a 24-hour cooldown lockout duration that applies to all endpoints simultaneously, effectively denying legitimate users password-based authentication until the patch is deployed. No public exploit code or active in-the-wild exploitation has been confirmed, but the attack requires no privileges and can be automated trivially.
MyTube versions prior to 1.8.71 allow unauthenticated remote attackers to register arbitrary passkeys and obtain full administrator access without any existing credentials. The vulnerability stems from exposed passkey registration endpoints that lack authentication checks and automatically grant admin tokens to any successfully registered passkey, enabling complete application compromise. Vendor-released patch version 1.8.71 addresses this flaw.
MyTube versions prior to 1.8.69 suffer from an authorization bypass in the `/api/settings/import-database` endpoint that allows low-privilege authenticated users to upload and replace the application's SQLite database entirely, resulting in complete application compromise. The vulnerability affects self-hosted instances of MyTube and extends to other POST routes using the same flawed authorization mechanism. No public exploit code or active exploitation has been confirmed at time of analysis, but the fix is available in version 1.8.69.
MyTube self-hosted video downloader has an authorization bypass (CVSS 9.8) that allows unauthenticated access to administrative functions in versions 1.7.65 and prior.
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized propertie...
MyTube versions 1.7.78 and earlier allow authenticated users to bypass authorization controls and export the complete application database without proper permission validation. An attacker with guest-level access can retrieve sensitive data they are not authorized to access through the unprotected database export endpoint. A patch is available to address this authorization bypass vulnerability.
Mytube versions up to 1.7.71 contains a vulnerability that allows attackers to bypass IP-based rate limiting on general API endpoints (CVSS 6.5).
MyTube deployments running in multi-user mode (loginEnabled=true) expose all locally stored and cloud-proxied media - videos, thumbnails, small thumbnails, avatars, subtitles and cloud signed URLs - to unauthenticated clients because the static and cloud route handlers are mounted before the authentication middleware. An attacker with network reach to the instance can fetch `/videos/*`, `/images/*`, `/subtitles/*`, `/avatars/*`, `/api/cloud/thumbnail-cache/*` and `/cloud/videos|images/:filename` without any session cookie, token or user interaction, and can combine this with the separate hidden-video path leak to download media the operator intended to hide. The default single-user configuration (loginEnabled=false) has no authentication boundary and is not affected; the flaw is fixed in version 1.10.3, a public PoC reference (curl-based request examples) is documented in the advisory, and there is no indication of confirmed active exploitation (no CISA KEV listing).
MyTube through 1.10.2, when deployed in multi-user mode with loginEnabled=true and a visitor password configured, lets an authenticated visitor retrieve hidden (visibility=0) video records and then download the associated media and subtitles because the backend video queries and static media routes do not enforce the visitor's intended public-only role restriction. The GitHub security advisory includes a public proof-of-concept request sequence; it is not independently verified as working exploit code, and no CISA KEV entry or confirmed active exploitation was reported. Deployments using the default loginEnabled=false single-user mode are unaffected.
MyTube prior to version 1.8.72 permits unauthenticated attackers to trigger indefinite account lockouts affecting both administrator and visitor authentication by exploiting a shared, globally-scoped login attempt counter across three publicly accessible password verification endpoints. An attacker can repeatedly send invalid authentication requests to any endpoint, progressively increasing a 24-hour cooldown lockout duration that applies to all endpoints simultaneously, effectively denying legitimate users password-based authentication until the patch is deployed. No public exploit code or active in-the-wild exploitation has been confirmed, but the attack requires no privileges and can be automated trivially.
MyTube versions prior to 1.8.71 allow unauthenticated remote attackers to register arbitrary passkeys and obtain full administrator access without any existing credentials. The vulnerability stems from exposed passkey registration endpoints that lack authentication checks and automatically grant admin tokens to any successfully registered passkey, enabling complete application compromise. Vendor-released patch version 1.8.71 addresses this flaw.
MyTube versions prior to 1.8.69 suffer from an authorization bypass in the `/api/settings/import-database` endpoint that allows low-privilege authenticated users to upload and replace the application's SQLite database entirely, resulting in complete application compromise. The vulnerability affects self-hosted instances of MyTube and extends to other POST routes using the same flawed authorization mechanism. No public exploit code or active exploitation has been confirmed at time of analysis, but the fix is available in version 1.8.69.
MyTube self-hosted video downloader has an authorization bypass (CVSS 9.8) that allows unauthenticated access to administrative functions in versions 1.7.65 and prior.
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized propertie...
MyTube versions 1.7.78 and earlier allow authenticated users to bypass authorization controls and export the complete application database without proper permission validation. An attacker with guest-level access can retrieve sensitive data they are not authorized to access through the unprotected database export endpoint. A patch is available to address this authorization bypass vulnerability.
Mytube versions up to 1.7.71 contains a vulnerability that allows attackers to bypass IP-based rate limiting on general API endpoints (CVSS 6.5).