CVE-2026-63433

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...