CVE-2026-63434

In MyTube versions prior to 1.10.6 , a visitor-role user can exploit an improper input validation vulnerability in the statistics ingest endpoint (handled by ingestEvents in backend/src/controllers/statisticsController.ts). When statisticsEnabled and statisticsTrackVisitorActivity are active, the...

CVE-2026-63434 MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in...

EUVD-2026-116165

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in...

CVE-2026-63434: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in...