{"id":"CVE-2026-63433","kind":"vulnerability","aliases":["CVE-2026-63433"],"related":[],"title":"MyTube: CSRF check skipped for any x-api-key header, enabling admin actions","description":"MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.","summary":"MyTube, a self-hosted video downloader, exempts requests carrying any x-api-key header from CSRF protection without validating the key. With a permissive CORS origin setting, a lured logged-in administrator's browser can be made to send state-changing requests that delete media, start downloads or change subscriptions.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mytube","node.js","package","self-hosted"],"not_affected_if":["patched-1.10.6","restrictive-cors-origins"],"how_to_check":"- Check the MyTube version; affected versions are those before `1.10.6`.\n- Check whether `CORS_ALLOWED_ORIGINS` is set to a permissive value in the deployment configuration.","fix":"- Move MyTube to version `1.10.6` or later.","status":"open","published_at":"2026-11-03T20:18:15+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:50:24+00:00","updated_at":"2026-11-03T20:50:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T20:50:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move MyTube to version `1.10.6` or later.","reach":"internet","title":"MyTube: CSRF check skipped for any x-api-key header, enabling admin actions","impact":"high","summary":"MyTube, a self-hosted video downloader, exempts requests carrying any x-api-key header from CSRF protection without validating the key. With a permissive CORS origin setting, a lured logged-in administrator's browser can be made to send state-changing requests that delete media, start downloads or change subscriptions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mytube","self-hosted","node.js"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker performs administrator actions like deleting media through victim's session","analyst_note":"","how_to_check":"- Check the MyTube version; affected versions are those before `1.10.6`.\n- Check whether `CORS_ALLOWED_ORIGINS` is set to a permissive value in the deployment configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-1.10.6","restrictive-cors-origins"],"who_is_affected":"Self-hosted MyTube instances before 1.10.6 that use a permissive CORS_ALLOWED_ORIGINS setting and have an administrator who uses a browser with an active session. Instances with a restrictive CORS origin list or without a logged-in administrator session are less exposed. The sources do not say whether default configurations are permissive.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4329,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63433':17A,20A '1.10.6':96C,205C 'action':14A 'admin':13A 'administr':61B,146C,187C 'allow':136C,183C 'api':9A,40B,117C,129C,166C,188C 'api-key':128C,165C 'apikey':123C 'arbitrari':164C 'attack':141C,149C 'attacker-control':148C 'authent':145C,174C 'author':122C 'backend/src/middleware/csrfconfig.ts':99C 'base':108C 'browser':63B 'carri':36B 'chang':71B,79B,160C,197C 'check':3A 'configur':138C 'content':151C 'control':150C 'cooki':173C 'cor':53B,135C 'cross':156C 'cross-origin':155C 'csrf':2A,44B,106C,178C 'cve':15A,18A 'deleg':100C 'delet':74B,192C 'destruct':184C 'download':33B,77B,87C,195C 'enabl':12A 'exempt':34B,107C 'fix':202C 'grant':104C 'header':11A,42B,119C 'host':26B,31B,86C 'isapikeyrequest':102C 'issu':200C 'key':10A,41B,49B,118C,130C,167C 'log':59B 'logged-in':58B 'lure':57B,143C 'made':66B 'media':75B,193C 'mytub':1A,21B,27B,81C 'node.js':22B 'oper':189C 'origin':54B,137C,157C 'packag':23B 'permiss':52B,134C 'player':89C 'presenc':112C 'prior':94C 'protect':45B 'rather':125C 'request':35B,72B,161C,176C 'self':25B,30B,85C 'self-host':24B,29B,84C 'send':68B,153C 'session':172C 'set':55B 'sever':91C 'shouldskipcsrfprotect':97C 'skip':4A,182C 'start':76B 'state':70B,159C 'state-chang':69B,158C 'subscript':80B,198C 'success':127C 'token':179C 'trigger':194C 'unauthent':140C 'valid':47B,131C,180C 'valu':124C,168C 'version':204C 'victim':170C 'video':32B,92C 'websit':93C 'without':46B 'x':8A,39B,116C 'x-api-key':7A,38B,115C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MyTube instances before 1.10.6 that use a permissive CORS_ALLOWED_ORIGINS setting and have an administrator who uses a browser with an active session. Instances with a restrictive CORS origin list or without a logged-in administrator session are less exposed. The sources do not say whether default configurations are permissive.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mytube","nodejs","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-01T05:03:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63433","severity":null,"published_at":"2026-11-03T20:18:15+00:00","modified_at":"2026-11-03T20:18:15+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[{"id":60579,"url":"https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60580,"url":"https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T05:03:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}