Live › vulnerability › CVE-2026-63434
MyTube, a self-hosted video downloader and player, lets a visitor-role user submit statistics events with client-chosen platform, source and session values before 1.10.6, when statistics and visitor tracking are enabled. An attacker can therefore inflate or distort the view counts, download counts and source breakdowns that administrators see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 20:49 UTC. All times on this page are UTC.
Only deployments that run MyTube before 1.10.6 with both statistics settings turned on and allow visitor-role accounts can be affected. The issue affects analytics integrity, not server control, so instances without visitor accounts or with statistics off can skip it.
No product ranges from the sources yet.
1.10.6.statisticsEnabled and statisticsTrackVisitorActivity are both enabled in the MyTube configuration.1.10.6.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-63434")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.