CVE-2026-33935 affects franklioxygen MyTube versions prior to 1.8.72. It allows an unauthenticated attacker to cause a denial of service by locking out administrator and visitor accounts from password-based authentication. The vulnerability arises because three publicly accessible password verification endpoints share a single file-backed login attempt state, which tracks failed attempts and cooldown periods globally. An attacker can repeatedly trigger failed login attempts to progressively increase the lockout duration up to 24 hours, effectively preventing legitimate users from logging in. The lockout can be maintained indefinitely by continuing this pattern. Version 1.8.72 addresses this issue.
CVE-2026-33890 is a high-severity improper access control vulnerability in franklioxygen MyTube versions prior to 1.8.71. An unauthenticated attacker can register an arbitrary passkey via exposed endpoints without authentication and then use that passkey to gain full administrative access. This allows complete compromise of the application without needing any existing credentials. The issue is fixed in version 1.8.71.
CVE-2026-33735 is an authorization bypass vulnerability in franklioxygen MyTube versions prior to 1.8.69. It affects the /api/settings/import-database endpoint, allowing attackers with low-privilege credentials to upload and replace the entire SQLite database of the application. This leads to a full compromise of the application. The issue also affects other POST routes. Version 1.8.69 addresses this vulnerability.
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.
CVE-2026-23848 is a medium severity vulnerability in franklioxygen's MyTube versions prior to 1.7.71. It allows unauthenticated attackers to bypass IP-based rate limiting by spoofing the X-Forwarded-For header, enabling unlimited requests to API endpoints. This can lead to denial-of-service conditions and abuse of rate-limited functionality. The vulnerability arises from reliance on untrusted input for security decisions (CWE-807). No authentication or user interaction is required, and the vulnerability affects availability primarily, with limited confidentiality impact. A patch was released in version 1.7.71 to address this issue.
MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next().