CVE-2026-63433
Received Received - Intake

Stored XSS in MyTube Media Player

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63433
EUVD
EUVD-2026-116195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
franklioxygen MyTube < 1.10.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) protection bypass in the MyTube application affecting versions 1.10.4 and earlier. The CSRF protection middleware only checks for the presence of an x-api-key header, not its validity. This allows an attacker to bypass CSRF token validation by including an arbitrary x-api-key header in a cross-origin request if the server's CORS policy permits the attacker's origin.

Detection Guidance

Check MyTube version with: curl -s https://your-mytube-instance.com/package.json | grep version. If version is 1.10.4 or earlier, the system is vulnerable. Review CORS headers with: curl -I https://your-mytube-instance.com to confirm permissive origins. Monitor logs for unusual POST/DELETE requests with x-api-key headers.

Impact Analysis

An attacker can trick an authenticated administrator into visiting a malicious page that sends a forged POST or DELETE request with an arbitrary x-api-key header. The server processes the request without validating the CSRF token, enabling unauthorized actions such as deleting videos, triggering downloads, or altering subscriptions. This requires a permissive CORS configuration, which is common in self-hosted deployments.

Mitigation Strategies

Upgrade MyTube to version 1.10.6 or later immediately. If upgrading is not possible, restrict CORS_ALLOWED_ORIGINS to trusted domains only. Disable API key-based CSRF bypass by reviewing and updating csrfConfig.ts to validate API keys properly. Rotate all API keys if they may have been exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...