Live › vulnerability › CVE-2026-62302
MyTube, a self-hosted video downloader, mounts its static media and cloud routes before its authentication middleware. An unauthenticated visitor can fetch local videos, images, avatars, subtitles and cloud-signed media directly, including hidden videos.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Deployments running MyTube before 1.10.3 with loginEnabled=true are exposed, because the static media and cloud routes sit outside the authentication stack and the frontend login does not protect direct media URLs. Default single-user deployments with loginEnabled=false have no authentication boundary to bypass, so they are not affected by the bypass itself.
No product ranges from the sources yet.
1.10.3 or later is fixed; anything earlier is affected.loginEnabled=true in the MyTube configuration; the flaw only matters when login is turned on./videos/ or /images/ without logging in and see whether media is returned instead of a 401.1.10.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in registration order, staticRoutes.ts and cloudRoutes.ts remain outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access local videos through /videos/*, thumbnails through /images/* and /images-small/*, avatars through /avatars/*, subtitles through /subtitles/*, cloud thumbnail caches through /api/cloud/thumbnail-cache/*, and cloud signed URLs or redirects through /cloud/videos/:filename and /cloud/images/:filename. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-62302")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.