Authentication Bypass in MyTube Video Downloader

CVE-2026-62302

What is CVE-2026-62302?

MyTube, a self-hosted video downloader, is exposed to a vulnerability that allows unauthenticated users to access local videos and other media files. The issue arises because the order of middleware registration in the application's code permits direct access to resources even when user authentication is enabled. Specifically, routes for videos, images, and cloud-based content are not protected by authentication mechanisms, leading to potential unauthorized downloads. This flaw is especially critical for single-user deployments where no login boundaries exist, allowing users to access hidden media without valid credentials. The security issue is addressed in version 1.10.3.

References