CVE-2026-62301

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only...

CVE-2026-62301

Prior to version 1.10.3 , MyTube —a self-hosted video downloader and player—is vulnerable to a Missing Authorization (CWE-862) flaw when loginEnabled=true and a visitor password is configured. The root cause is that roleBasedAuthMiddleware.ts allows all visitor GET requests, while storageService/...

CVE-2026-62301 MyTube: Visitor Can Access Hidden Video Metadata and Content

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only...

CVE-2026-62301: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when loginEnabled=true and a visitor password is configured. The frontend filter in VideoContext.tsx is only...