{"id":"CVE-2026-63434","kind":"vulnerability","aliases":["CVE-2026-63434"],"related":[],"title":"MyTube: visitors can forge statistics events and skew analytics","description":"MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.","summary":"MyTube, a self-hosted video downloader and player, lets a visitor-role user submit statistics events with client-chosen platform, source and session values before 1.10.6, when statistics and visitor tracking are enabled. An attacker can therefore inflate or distort the view counts, download counts and source breakdowns that administrators see.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mytube","package","self-hosted","statistics"],"not_affected_if":["no-visitor-accounts","statistics-disabled","version-1.10.6-or-later"],"how_to_check":"- Check the MyTube version in use; affected versions are those before `1.10.6`.\n- Check whether `statisticsEnabled` and `statisticsTrackVisitorActivity` are both enabled in the MyTube configuration.","fix":"- MyTube: move to `1.10.6`.","status":"open","published_at":"2026-11-03T20:18:15+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:51:57+00:00","updated_at":"2026-11-03T20:51:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T20:51:57Z","model":"claude-haiku-5-5","output":{"fix":"- MyTube: move to `1.10.6`.","reach":"network","title":"MyTube: visitors can forge statistics events and skew analytics","impact":"low","summary":"MyTube, a self-hosted video downloader and player, lets a visitor-role user submit statistics events with client-chosen platform, source and session values before 1.10.6, when statistics and visitor tracking are enabled. An attacker can therefore inflate or distort the view counts, download counts and source breakdowns that administrators see.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mytube","self-hosted","statistics"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker fabricates analytics events, corrupting administrator-visible view and download statistics.","analyst_note":"","how_to_check":"- Check the MyTube version in use; affected versions are those before `1.10.6`.\n- Check whether `statisticsEnabled` and `statisticsTrackVisitorActivity` are both enabled in the MyTube configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["statistics-disabled","no-visitor-accounts","version-1.10.6-or-later"],"who_is_affected":"Only deployments that run MyTube before 1.10.6 with both statistics settings turned on and allow visitor-role accounts can be affected. The issue affects analytics integrity, not server control, so instances without visitor accounts or with statistics off can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4363,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63434':12A,15A '1.10.6':50B,91C,195C 'accept':121C 'actorrol':179C 'administr':74B,162C 'administrator-vis':161C 'analyt':9A,144C,174C 'arbitrari':155C 'attack':59B 'attribut':151C,171C 'backend/src/controllers/statisticscontroller.ts':115C 'breakdown':72B,169C 'chosen':43B 'client':42B,124C 'client-chosen':41B 'client-control':123C 'control':125C 'corrupt':160C 'count':67B,69B,165C,167C 'cve':10A,13A 'deriv':135C,178C 'distort':64B 'download':28B,68B,82C,166C 'enabl':57B,97C 'endpoint':110C 'event':6A,39B,105C,141C,153C 'fabric':152C 'field':130C,182C 'fix':192C 'forg':4A 'forgeabl':185C 'handl':111C 'handler':117C 'host':20B,26B,81C 'inflat':62B 'ingest':109C 'ingestev':113C 'issu':188C,190C 'let':31B 'mytub':1A,16B,22B,76C 'packag':17B 'pass':139C 'path':146C 'persist':145C 'platform':44B,126C,156C,168C 'player':30B,84C 'prior':89C 'read':118C 'req.body.events':119C 'role':35B,101C 'see':75B 'self':19B,25B,80C 'self-host':18B,24B,79C 'server':133C,177C 'server-deriv':176C 'server-sid':132C 'session':47B,159C,173C 'sessionid':129C 'sever':86C 'side':134C 'skew':8A 'sourc':45B,71B,157C,170C 'sourcekind':127C 'statist':5A,21B,38B,52B,108C 'statisticsen':93C 'statisticstrackvisitoract':95C 'submit':37B,104C 'surfac':181C 'therefor':61B,150C 'track':55B 'user':36B,102C 'valid':137C 'valu':48B 'version':194C 'video':27B,87C 'view':66B,164C 'visibl':163C 'visitor':2A,34B,54B,100C,148C 'visitor-rol':33B,99C 'websit':88C 'without':131C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run MyTube before 1.10.6 with both statistics settings turned on and allow visitor-role accounts can be affected. The issue affects analytics integrity, not server control, so instances without visitor accounts or with statistics off can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mytube","package","selfhosted","statistics"],"campaign_type":null,"first_public_at":"2026-07-01T05:03:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63434","severity":null,"published_at":"2026-11-03T20:18:15+00:00","modified_at":"2026-11-03T20:18:15+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null}],"documents":[{"id":60581,"url":"https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60582,"url":"https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60583,"url":"https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60584,"url":"https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60585,"url":"https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T05:03:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}