CVE-2026-63434— MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning

Quick assessment

Affected

franklioxygen MyTube

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MyTube 是一款支持多个视频网站的自托管下载与播放工具。在 1.10.6 版本之前，当和配置项被启用时，拥有访客（visitor）角色的用户可以向由中函数处理的统计摄入端点提交事件。该处理程序直接读取，在未进行服务器端推导或验证的情况下，接受由客户端控制的、和字段，随后将事件传递给分析数据持久化路径。因此，访客可以将伪造的事件关联到任意的平台、来源和会话，从而破坏管理员可见的观看次数、下载次数、平台分布、来源归因以及会话分析等统计数据。值得注意的是，服务器端生成的和字段无法通过此漏洞被伪造。

CVSS 4.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1566 · Phishing T1070 · Indicator Removal

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning

Source: CVE Program / CVE List V5

Vulnerability Description

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
franklioxygen	MyTube	< 1.10.6	-

II. Public POCs for CVE-2026-63434

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63434

请登录查看更多情报信息。

Other References for CVE-2026-63434 (5)

https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6 x_refsource_MISC
https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7 x_refsource_CONFIRM
https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7 x_refsource_MISC
https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66 x_refsource_MISC
https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63434

IV. Related Vulnerabilities

Same product: MyTube

Same vendor: franklioxygen

Same weakness: CWE-20