Unauthorized Access in MyTube Video Player and Downloader

CVE-2026-62301

What is CVE-2026-62301?

The MyTube video downloader and player prior to version 1.10.3 is susceptible to a security issue that allows unauthorized access to backend video resources. While the system is intended to restrict visibility based on user roles when the login feature is enabled, misconfigurations expose sensitive video metadata and content paths to unauthenticated visitors. This situation arises due to the improper handling of role-based access in various backend APIs, allowing access to hidden videos that should remain private. As a result, attackers can enumerate available videos or access file paths directly, leading to sensitive information leakage. The issue has been addressed in version 1.10.3, which implements necessary verification checks to protect against such unauthorized access.

References