CVE-2026-63433

The self-hosted video downloader and player MyTube is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.10.6 . The root cause is located in backend/src/middleware/csrfConfig.ts, where the shouldSkipCsrfProtection() function incorrectly grants a CSRF exemption by chec...