Live › vulnerability › CVE-2026-63433
MyTube, a self-hosted video downloader, exempts requests carrying any x-api-key header from CSRF protection without validating the key. With a permissive CORS origin setting, a lured logged-in administrator's browser can be made to send state-changing requests that delete media, start downloads or change subscriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Self-hosted MyTube instances before 1.10.6 that use a permissive CORS_ALLOWED_ORIGINS setting and have an administrator who uses a browser with an active session. Instances with a restrictive CORS origin list or without a logged-in administrator session are less exposed. The sources do not say whether default configurations are permissive.
No product ranges from the sources yet.
1.10.6.CORS_ALLOWED_ORIGINS is set to a permissive value in the deployment configuration.1.10.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-63433")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.