{"id":"CVE-2026-62302","kind":"vulnerability","aliases":["CVE-2026-62302"],"related":[],"title":"MyTube: static media routes skip login, exposing hidden videos","description":"MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.","summary":"MyTube, a self-hosted video downloader, mounts its static media and cloud routes before its authentication middleware. An unauthenticated visitor can fetch local videos, images, avatars, subtitles and cloud-signed media directly, including hidden videos.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["express","media-server","mytube","package","self-hosted"],"not_affected_if":["default-config","loginenabled-false","version-1.10.3-or-later"],"how_to_check":"- Check the MyTube version: `1.10.3` or later is fixed; anything earlier is affected.\n- Look for `loginEnabled=true` in the MyTube configuration; the flaw only matters when login is turned on.\n- Request `/videos/` or `/images/` without logging in and see whether media is returned instead of a 401.","fix":"- MyTube: move to `1.10.3`, which fixes this issue.","status":"open","published_at":"2026-10-30T20:17:12+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:15+00:00","updated_at":"2026-10-30T20:26:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T20:26:15Z","model":"claude-haiku-5-5","output":{"fix":"- MyTube: move to `1.10.3`, which fixes this issue.","reach":"internet","title":"MyTube: static media routes skip login, exposing hidden videos","impact":"medium","summary":"MyTube, a self-hosted video downloader, mounts its static media and cloud routes before its authentication middleware. An unauthenticated visitor can fetch local videos, images, avatars, subtitles and cloud-signed media directly, including hidden videos.","audience":"businesses","category":"package","nicknames":[],"who_cares":["self-hosted","mytube","express","media-server"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers download hidden videos and media files","analyst_note":"","how_to_check":"- Check the MyTube version: `1.10.3` or later is fixed; anything earlier is affected.\n- Look for `loginEnabled=true` in the MyTube configuration; the flaw only matters when login is turned on.\n- Request `/videos/` or `/images/` without logging in and see whether media is returned instead of a 401.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","loginEnabled-false","version-1.10.3-or-later"],"who_is_affected":"Deployments running MyTube before 1.10.3 with loginEnabled=true are exposed, because the static media and cloud routes sit outside the authentication stack and the frontend login does not protect direct media URLs. Default single-user deployments with loginEnabled=false have no authentication boundary to bypass, so they are not affected by the bypass itself.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4465,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62302':12A,15A '/api/cloud/thumbnail-cache':134C '/avatars':126C '/cloud/images':145C '/cloud/videos':142C '/images':121C '/images-small':123C '/subtitles':129C '/videos':118C '1.10.3':78C,213C '401':178C '404':160C 'access':114C 'api':174C 'authent':41B,105C,171C,203C 'authmiddlewar':87C 'avatar':51B,124C 'boundari':204C 'bypass':206C 'cach':132C 'call':80C 'client':112C 'cloud':37B,55B,130C,136C,157C,162C 'cloud-sign':54B 'cloudroutes.ts':101C 'combin':179C 'correct':176C 'cve':10A,13A 'default':194C 'deploy':200C 'direct':58B,154C 'download':31B,68C,190C 'even':107C 'expos':7A 'express':16B,93C 'fals':196C 'fetch':47B 'filenam':143C,146C 'fix':210C 'flaw':187C 'frontend':148C 'hidden':8A,60B,182C,192C 'hidden-video':181C 'host':24B,29B,67C 'imag':50B 'includ':59B 'issu':208C 'leak':185C 'local':48B,115C 'login':6A,149C 'loginen':109C,195C 'media':3A,18B,35B,57B,155C,193C 'media-serv':17B 'middlewar':42B,95C 'mount':32B,91C 'mytub':1A,20B,25B,62C 'order':98C 'outsid':103C 'packag':21B 'path':184C 'permit':188C 'player':70C 'prior':75C 'process':94C 'protect':153C,173C 'redirect':140C 'registerapirout':85C 'registercloudrout':83C 'registerstaticrout':81C 'registr':97C 'reject':172C 'remain':102C 'request':156C 'return':159C,177C 'rolebasedauthmiddlewar':89C 'rout':4A,38B,158C,175C 'self':23B,28B,66C 'self-host':22B,27B,65C 'server':19B 'server.ts':79C 'sever':72C 'sign':56B,137C 'singl':198C 'single-us':197C 'skip':5A 'stack':106C 'static':2A,34B 'staticroutes.ts':99C 'storag':163C 'subtitl':52B,127C 'thumbnail':119C,131C 'true':110C 'unauthent':44B,111C,189C 'unconfigur':165C 'url':138C 'user':199C 'version':77C,212C 'video':9A,30B,49B,61B,73C,116C,183C 'visitor':45B 'wall':150C 'websit':74C","nicknames":[],"mitigations":[],"who_affected":"Deployments running MyTube before 1.10.3 with loginEnabled=true are exposed, because the static media and cloud routes sit outside the authentication stack and the frontend login does not protect direct media URLs. Default single-user deployments with loginEnabled=false have no authentication boundary to bypass, so they are not affected by the bypass itself.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62302","severity":null,"published_at":"2026-10-30T20:17:12+00:00","modified_at":"2026-10-30T20:17:12+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}