Skip to content
OpenAdvisories

Vendor

franklioxygen

11 known vulnerabilities.

Products

MyTube 11
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-63433

    MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value

    MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-…

    franklioxygen MyTube
  • Medium 4.3
    CVE-2026-63434

    MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning

    MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents i…

    franklioxygen MyTube
  • Medium 6.5
    CVE-2026-23848

    MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing

    MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing allows unauthenticated attackers to bypass IP-based rate limiting on general API endpoints. Attacke…

    franklioxygen MyTube