{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C05A30F-C789-4252-9C6D-E381B1D1E670",
              "versionEndExcluding": "1.7.66",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next()."
    },
    {
      "lang": "es",
      "value": "MyTube es un descargador y reproductor autoalojado para varios sitios web de v\u00eddeo. Una vulnerabilidad presente en la versi\u00f3n 1.7.65 y potencialmente en versiones anteriores permite a los usuarios no autenticados eludir la comprobaci\u00f3n de autenticaci\u00f3n obligatoria en el roleBasedAuthMiddleware. Simplemente al no proporcionar una cookie de autenticaci\u00f3n (haciendo que req.user sea indefinido), una solicitud se pasa incorrectamente a los manejadores posteriores. Todos los usuarios que ejecutan MyTube con loginEnabled: true se ven afectados. Esta falla permite a un atacante acceder y modificar la configuraci\u00f3n de la aplicaci\u00f3n a trav\u00e9s de /API/settings, cambiar las contrase\u00f1as administrativas y de visitante, y acceder a otras rutas protegidas que dependen de este middleware espec\u00edfico. El problema est\u00e1 parcheado en la v1.7.66. Los mantenedores de MyTube recomiendan a todos los usuarios actualizar a la versi\u00f3n v1.7.64 como m\u00ednimo inmediatamente para asegurar sus instancias. La soluci\u00f3n asegura que el middleware bloquea expl\u00edcitamente las solicitudes si un usuario no est\u00e1 autenticado, en lugar de recurrir a next(). Aquellos que no puedan actualizar inmediatamente pueden mitigar el riesgo restringiendo el acceso a la red usando un cortafuegos o un proxy inverso (como Nginx) para restringir el acceso a los puntos finales /API/ solo a direcciones IP de confianza o, si se sienten c\u00f3modos editando el c\u00f3digo fuente, aplicar un parche manualmente localizando roleBasedAuthMiddleware y asegur\u00e1ndose de que la l\u00f3gica recurra a un error (401 Unauthorized) cuando req.user sea indefinido, en lugar de llamar a next()."
    }
  ],
  "id": "CVE-2026-23837",
  "lastModified": "2026-02-02T13:24:34.437",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-19T21:15:50.903",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}