---
id: "CVE-2026-63433"
kind: "vulnerability"
aliases: ["CVE-2026-63433"]
title: "MyTube: CSRF check skipped for any x-api-key header, enabling admin actions"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mytube", "node.js", "package", "self-hosted"]
not_affected_if: ["patched-1.10.6", "restrictive-cors-origins"]
published_at: "2026-11-03T20:18:15+00:00"
first_seen_at: "2026-11-03T20:49:22+00:00"
updated_at: "2026-11-03T20:50:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63433", "first_seen_at": "2026-11-03T20:49:22+00:00"}]
---

# MyTube: CSRF check skipped for any x-api-key header, enabling admin actions

MyTube, a self-hosted video downloader, exempts requests carrying any x-api-key header from CSRF protection without validating the key. With a permissive CORS origin setting, a lured logged-in administrator's browser can be made to send state-changing requests that delete media, start downloads or change subscriptions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MyTube version; affected versions are those before `1.10.6`.
- Check whether `CORS_ALLOWED_ORIGINS` is set to a permissive value in the deployment configuration.

## Fix

- Move MyTube to version `1.10.6` or later.

## Timeline

- 2026-11-03T20:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63433

## Documents

- [advisory] Vendor advisory: github.com https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r
- [fix] Patch: github.com https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89

## From the sources

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_