CVE-2026-24140: franklioxygen MyTube · Mass Assignment
Affects franklioxygen MyTubeSource CVE Database V5
Not known to be exploited · CVSS 2.7 Low : upgrade to 1.7.79 when convenient.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.7.79
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade MyTube and franklioxygen/MyTube to 1.7.79.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| franklioxygenMyTube | Affected
| Fixed in
|
GitHubfranklioxygen/MyTubepkg:github/franklioxygen/MyTubeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
European organizations should immediately upgrade MyTube to version 1.7.79 or later, where the vulnerability is fixed by enforcing strict validation of allowed settings properties in the saveSettings() function. Until upgrading, administrators should restrict access to the settings management interface to trusted personnel only, minimizing the risk of high-privilege attackers exploiting the flaw. Implement application-layer input validation to whitelist acceptable configuration keys and reject any unexpected parameters. Conduct thorough audits of existing settings to detect unauthorized modifications. Employ monitoring and alerting on configuration changes to quickly identify suspicious activity. Additionally, enforce strong authentication and access controls to prevent unauthorized high-privilege access. Regularly review and update software dependencies and maintain a patch management process to promptly address future vulnerabilities.
Description
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.