CVE-2026-23837

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23837", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-16T15:46:40.842Z", "datePublished": "2026-01-19T20:09:37.223Z", "dateUpdated": "2026-01-20T17:24:06.897Z"}, "containers": {"cna": {"title": "MyTube has an Authorization Bypass vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664"}, {"name": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e", "tags": ["x_refsource_MISC"], "url": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e"}], "affected": [{"vendor": "franklioxygen", "product": "MyTube", "versions": [{"version": "< 1.7.66", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T20:09:37.223Z"}, "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next()."}], "source": {"advisory": "GHSA-cmvj-g69f-8664", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T17:23:30.927442Z", "id": "CVE-2026-23837", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T17:24:06.897Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T17:23:30.927442Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T17:24:03.210Z"}}], "cna": {"title": "MyTube has an Authorization Bypass vulnerability", "source": {"advisory": "GHSA-cmvj-g69f-8664", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "franklioxygen", "product": "MyTube", "versions": [{"status": "affected", "version": "< 1.7.66"}]}], "references": [{"url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664", "name": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e", "name": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next()."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-19T20:09:37.223Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23837", "state": "PUBLISHED", "dateUpdated": "2026-01-20T17:24:06.897Z", "dateReserved": "2026-01-16T15:46:40.842Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-19T20:09:37.223Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "MyTube", "vendor": "franklioxygen", "versions": [{"status": "affected", "version": "< 1.7.66"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C05A30F-C789-4252-9C6D-E381B1D1E670", "versionEndExcluding": "1.7.66", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next()."}, {"lang": "es", "value": "MyTube es un descargador y reproductor autoalojado para varios sitios web de v\u00eddeo. Una vulnerabilidad presente en la versi\u00f3n 1.7.65 y potencialmente en versiones anteriores permite a los usuarios no autenticados eludir la comprobaci\u00f3n de autenticaci\u00f3n obligatoria en el roleBasedAuthMiddleware. Simplemente al no proporcionar una cookie de autenticaci\u00f3n (haciendo que req.user sea indefinido), una solicitud se pasa incorrectamente a los manejadores posteriores. Todos los usuarios que ejecutan MyTube con loginEnabled: true se ven afectados. Esta falla permite a un atacante acceder y modificar la configuraci\u00f3n de la aplicaci\u00f3n a trav\u00e9s de /API/settings, cambiar las contrase\u00f1as administrativas y de visitante, y acceder a otras rutas protegidas que dependen de este middleware espec\u00edfico. El problema est\u00e1 parcheado en la v1.7.66. Los mantenedores de MyTube recomiendan a todos los usuarios actualizar a la versi\u00f3n v1.7.64 como m\u00ednimo inmediatamente para asegurar sus instancias. La soluci\u00f3n asegura que el middleware bloquea expl\u00edcitamente las solicitudes si un usuario no est\u00e1 autenticado, en lugar de recurrir a next(). Aquellos que no puedan actualizar inmediatamente pueden mitigar el riesgo restringiendo el acceso a la red usando un cortafuegos o un proxy inverso (como Nginx) para restringir el acceso a los puntos finales /API/ solo a direcciones IP de confianza o, si se sienten c\u00f3modos editando el c\u00f3digo fuente, aplicar un parche manualmente localizando roleBasedAuthMiddleware y asegur\u00e1ndose de que la l\u00f3gica recurra a un error (401 Unauthorized) cuando req.user sea indefinido, en lugar de llamar a next()."}], "id": "CVE-2026-23837", "lastModified": "2026-06-17T10:22:10.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23837", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T17:23:30.927442Z", "version": "2.0.3"}}]}, "published": "2026-01-19T21:15:50.903", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:59:20.482264+00:00", "value": {"mitigation_remediation": ["Upgrade MyTube to v1.7.66 or later so that the middleware blocks unauthenticated requests with a 401 error. ", "If an upgrade is not immediately possible, restrict network access to the /api/ endpoints using a firewall or reverse proxy, allowing only trusted IP addresses to reach them. ", "As a temporary patch, edit the roleBasedAuthMiddleware code to return a 401 Unauthorized response whenever req.user is undefined instead of calling next()."], "summary": {"action": "Immediate Patch", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the FrankLioxygen MyTube application, specifically versions 1.7.65 and earlier. Any instance that runs with loginEnabled set to true is impacted regardless of the exact version number, until the middleware is patched. The defect was fixed in the 1.7.66 release.", "description_and_impact": "The flaw resides in the roleBasedAuthMiddleware of MyTube, where unauthenticated requests are allowed to proceed to downstream handlers. An attacker who omits the authentication cookie can cause the middleware to treat req.user as undefined and simply call next(), thereby bypassing the mandatory authentication check. As a result, the attacker can access and modify application settings through /api/settings, change administrative and visitor passwords, and consume any protected routes that depend on this middleware. This is a classic authorization bypass based on missing access control checks (CWE-863).", "risk_and_exploitability": "The CVSS base score of 9.8 marks this as Critical, while the EPSS score of less than 1% indicates that exploitation attempts are expected to be rare but possible. The vulnerability is not currently listed in the CISA KEV catalog, yet the lack of authentication enforcement makes remote exploitation straightforward: an unauthenticated user can issue requests to any protected API endpoint via an open network connection. The attacker has full control over settings and credentials once the bypass is achieved. High severity combined with low but non-zero exploit probability means that administrators should act promptly."}}}}, "created": "2026-01-20T08:40:30.616465+00:00", "updated": "2026-04-18T05:00:06.043431+00:00", "vendors": ["franklioxygen", "franklioxygen$PRODUCT$mytube"]}