MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
Affects MyTube installs with login enabled (loginEnabled=true). The advisory's CVSS score is 8.7 (high), and no vendor rating is given. Fixed in 1.10.3.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.10.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
MyTube, a self-hosted video downloader and player, fails to apply its login check to its static media and cloud routes, so anyone who can reach the server can fetch local videos, thumbnails, avatars, subtitles, and cloud-stored media without logging in. This lets unauthenticated users download media that should be hidden or restricted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- franklioxygen MyTube
fixed in 1.10.3
References 3
GitHub · franklioxygen/MyTube
Questions about CVE-2026-62302
What does this mean?
Static file routes in MyTube skip the login check, so requests without authentication can fetch local videos, subtitles, thumbnails, avatars and cloud signed URLs. Combined with a leak of hidden video paths, hidden videos and subtitles can also be downloaded without logging in.Source: github.com
Am I affected, and how do I check?
The issue applies to MyTube versions before 1.10.3 when login is enabled (loginEnabled=true). Cloud routes only serve content when cloud storage is configured; otherwise they return 404. To check a setup, look at the loginEnabled setting and the installed MyTube version.Source: github.com
What should I do about it?
Upgrade MyTube to version 1.10.3 or later, which is the fixed range given in the advisory.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data