MyTube: Unauthenticated media access via static routes bypassing login
Summary
MyTube, a self-hosted video downloader and player, registers its static media and cloud routes before the authentication middleware. When loginEnabled=true, unauthenticated clients can fetch local videos, thumbnails, avatars, subtitles and cloud signed URLs directly. Combined with the hidden-video visibility flaw (CVE-2026-62301), this allows unauthenticated download of hidden media.
Affected
- MyTube versions before 1.10.3 (CNA data; GitHub advisory lists up to v1.10.2)
- Only relevant when loginEnabled=true; default loginEnabled=false deployments have no authentication boundary to bypass
Fixed in
- Fixed in version 1.10.3 (commit 7cc7c6a7d297ccbd8bd2c76755129381b96f8456)
Workaround
- No vendor-documented workaround known. Unknown.
- Do not expose the instance directly to the internet; use a VPN or an authenticated proxy that also enforces login on media paths (/videos, /images, /images-small, /avatars, /subtitles, /cloud, /api/cloud/thumbnail-cache)
Exploitation
- No known exploitation in the wild at time of writing; not listed in CISA KEV.
- No public proof of concept found. Attack requires no credentials.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify all MyTube instances and their versions.
- Upgrade to 1.10.3, especially where loginEnabled is used.
- Remove direct internet exposure where possible.
- Check for the related CVE-2026-62301 at the same time.
- Review exposed media libraries for private or hidden content.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rwwf-29mq-5j43 github.com
- Fix commit 7cc7c6a7d297ccbd8bd2c76755129381b96f8456 github.com
- MyTube release v1.10.3 github.com
- VulDB entry 429351 vuldb.com
- Strix CVE-2026-62302 www.strix.ai
- CVE threat intelligence CVE-2026-62302 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:17.
Original description (NVD)
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.