CVE-2026-24140

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.

• CWE-915

• https://github.com/franklioxygen/MyTube/commit/9d737cb373f7af3e5c92d458e2832caf817b6de6Patch
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-c938-x24g-fxcxExploit, Third Party Advisory

Published

Jan 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24135Gogs is an open source self-hosted Git service. In version 0…8.1
• CVE-2026-24136Saleor is an e-commerce platform. Versions 3.2.0 through 3.2…7.5
• CVE-2026-24137sigstore framework is a common go library shared across sigs…5.8
• CVE-2026-24138FOG is a free open-source cloning/imaging/rescue suite/inven…7.5
• CVE-2026-24139MyTube is a self-hosted downloader and player for several vi…6.5
• CVE-2026-2414Authorization bypass through User-Controlled key vulnerabili…9.8
• CVE-2026-24141NVIDIA Model Optimizer for Windows and Linux contains a vuln…7.8
• CVE-2026-24142NVIDIA TRT-LLM for any platform contains a deserialization v…9.8
• CVE-2026-24146NVIDIA Triton Inference Server contains a vulnerability wher…7.5
• CVE-2026-24147NVIDIA Triton Inference Server contains a vulnerability in t…4.8
• CVE-2026-24148NVIDIA Jetson for JetPack contains a vulnerability in the sy…9.4
• CVE-2026-24149NVIDIA Megatron-LM for all platforms contains a vulnerabilit…7.8