CVE-2026-62301

Prior to version 1.10.3 , MyTube —a self-hosted video downloader and player—is vulnerable to a Missing Authorization (CWE-862) flaw when loginEnabled=true and a visitor password is configured. The root cause is that roleBasedAuthMiddleware.ts allows all visitor GET requests, while storageService/...