CVE-2026-62302 in MyTube
Summary
by MITRE • 10/30/2026
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in MyTube prior to version 1.10.3 stems from a critical misconfiguration in the middleware registration order within the Express.js application architecture. In web frameworks like Express, middleware functions are executed sequentially based on their definition order. The source code for server.ts incorrectly invokes registerStaticRoutes and registerCloudRoutes before registering the authentication middleware via registerApiRoutes. This structural flaw means that requests targeting static assets and cloud-related endpoints bypass the authMiddleware and roleBasedAuthMiddleware entirely. Consequently, even when the loginEnabled configuration flag is set to true, these specific routes remain accessible without any form of credential verification or session validation.
This architectural error results in a significant authentication bypass affecting multiple data access points. Unauthenticated actors can directly retrieve local video files through endpoints such as /videos/, fetch thumbnail images via /images/ and /images-small/, download user avatars from /avatars/, and obtain subtitle files through /subtitles/. Furthermore, cloud storage interactions are compromised, allowing unauthorized retrieval of cached thumbnails from /api/cloud/thumbnail-cache/ and accessing signed URLs or redirects for cloud-hosted videos and images at /cloud/videos/:filename and /cloud/images/:filename. The frontend interface may display a login wall that obscures these resources visually, but this is merely a client-side restriction; direct HTTP requests to the underlying API endpoints completely ignore this UI-level protection because the server never enforces authentication for these paths.
The operational impact of this vulnerability extends beyond simple data exposure due to its interaction with hidden content mechanisms. While cloud routes may return 404 errors when storage is unconfigured, static and local media routes actively serve content without rejection. This behavior, combined with potential path leaks regarding hidden videos, allows attackers to download sensitive or private media that was intended to be restricted to authenticated users only. It is important to note that in default single-user deployments where loginEnabled is set to false, this specific bypass does not constitute a security risk as there is no authentication boundary to circumvent; however, for any deployment utilizing multi-user capabilities or privacy features, the flaw represents a severe confidentiality breach.
From a classification perspective, this issue aligns with CWE-287 Improper Authentication and CWE-359 Exposure of Private Personal Information to an Unauthorized Actor. In terms of adversary tactics, it facilitates unauthorized data access consistent with ATT&CK technique T1005 Data from Local System Retrieval or T1530 Data from Cloud Storage Object Discovery if cloud resources are involved. The vulnerability is effectively remediated in version 1.10.3 by correcting the middleware registration sequence to ensure that authentication checks precede static and cloud route handling, thereby enforcing consistent access control across all endpoints regardless of their functional category.