Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62302— MyTube: Unauthenticated Media Access via Static Routes Bypassing Login

Quick assessment

Affected
franklioxygen MyTube
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MyTube 是一款支持多个视频网站的自托管下载器与播放器。在 1.10.3 版本之前， 文件在注册 （其中挂载了 和 ）之前，就先调用了 和 。由于 Express 框架按照注册顺序处理中间件，这导致 和 始终位于认证栈之外，即使配置了 也不例外。 因此，未认证客户端仍可访问以下资源： 本地视频： 缩略图： 和 头像： 字幕： 云缩略图缓存： 云签名 URL 或重定向： 和 前端登录页面无法阻止针对媒体资源的直接请求。当云存储未配置时，云路由会返回 404 错误，但这并非认证拒绝（受保护的 API 路由会正确返回

CVSS 8.7 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
franklioxygen MyTube < 1.10.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62302

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
Source: CVE Program / CVE List V5
Vulnerability Description
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
franklioxygen MyTube < 1.10.3 -

II. Public POCs for CVE-2026-62302

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62302

请登录查看更多情报信息。

Other References for CVE-2026-62302 (3)

IV. Related Vulnerabilities

Same product: MyTube
Same vendor: franklioxygen
Same weakness: CWE-306