CVE-2026-63434
Received Received - Intake

MyTube Analytics Data Corruption via Event Injection

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63434
EUVD
EUVD-2026-116165

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
franklioxygen MyTube < 1.10.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MyTube is a self-hosted video downloader and player. This vulnerability exists in versions before 1.10.6. When certain settings are enabled, a visitor-role user can send fake events to the statistics system. These events can manipulate view counts, download counts, and other analytics data by fabricating platform, source, and session information.

Detection Guidance

Check MyTube version for 1.10.6 or higher. Inspect server logs for unusual activity in the statistics ingest endpoint. Look for unexpected event submissions with forged platform, sourceKind, or sessionId fields.

Impact Analysis

If you use MyTube with statistics enabled, an attacker could falsify your analytics data. This could mislead you about actual usage, popularity, or trends. It may also affect decisions based on incorrect statistics, such as resource allocation or content strategy.

Mitigation Strategies

Upgrade MyTube to version 1.10.6 or later. Disable statisticsEnabled and statisticsTrackVisitorActivity if not required. Monitor statistics data for anomalies after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...