Cross-Site Request Forgery Vulnerability in MyTube Product by Frank Lioxygen
CVE-2026-63433

6.8MEDIUM

Key Information:

Vendor

Franklioxygen

Status
Mytube
Vendor
CVE Published:
3 November 2026

What is CVE-2026-63433?

MyTube, a self-hosted downloader and player for several video websites, is affected by a vulnerability prior to version 1.10.6. The issue arises in the shouldSkipCsrfProtection() method, where CSRF protection is mishandled. This method inadequately checks API key validation based solely on the presence of an x-api-key header or an Authorization: ApiKey value. An unauthenticated attacker can exploit this flaw by enticing an authenticated administrator to visit compromised content, which triggers a cross-origin request that bypasses CSRF token validation. Consequently, the attacker can perform unauthorized administrative actions, such as deleting media or altering subscriptions, using the victim's session authentication. Users are urged to update to version 1.10.6 to mitigate this vulnerability.

Affected Version(s)

MyTube < 1.10.6

References

https://github.com/franklioxygen/MyTube/security/advisori...
x_refsource_CONFIRM
https://github.com/franklioxygen/MyTube/commit/b2000d8b23...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.