---
id: "CVE-2026-62302"
kind: "vulnerability"
aliases: ["CVE-2026-62302"]
title: "MyTube: static media routes skip login, exposing hidden videos"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["express", "media-server", "mytube", "package", "self-hosted"]
not_affected_if: ["default-config", "loginenabled-false", "version-1.10.3-or-later"]
published_at: "2026-10-30T20:17:12+00:00"
first_seen_at: "2026-10-30T20:25:38+00:00"
updated_at: "2026-10-30T20:26:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62302", "first_seen_at": "2026-10-30T20:25:38+00:00"}]
---

# MyTube: static media routes skip login, exposing hidden videos

MyTube, a self-hosted video downloader, mounts its static media and cloud routes before its authentication middleware. An unauthenticated visitor can fetch local videos, images, avatars, subtitles and cloud-signed media directly, including hidden videos.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MyTube version: `1.10.3` or later is fixed; anything earlier is affected.
- Look for `loginEnabled=true` in the MyTube configuration; the flaw only matters when login is turned on.
- Request `/videos/` or `/images/` without logging in and see whether media is returned instead of a 401.

## Fix

- MyTube: move to `1.10.3`, which fixes this issue.

## Timeline

- 2026-10-30T20:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62302

## From the sources

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_