CVE-2026-62302 MyTube: Unauthenticated Media Access via Static Routes Bypassing Login

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in...

CVE-2026-62302

Prior to version 1.10.3 , the MyTube self-hosted downloader and player is vulnerable to unauthenticated media access . The root cause is that server.ts registers registerStaticRoutes and registerCloudRoutes before registerApiRoutes, placing these routes outside the authMiddleware and roleBasedAut...

CVE-2026-62302: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in...