CVE-2026-63433

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.

• CWE-352

• https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r
• https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r

Published

Nov 3, 2026

Last Modified

Nov 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63428HeyForm is an open-source form builder. Prior to version 3.0…5.8
• CVE-2026-63429HeyForm is an open-source form builder. Prior to version 3.0…8.6
• CVE-2026-6343Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…4.3
• CVE-2026-63430ammonia is a Rust library for repairing and securing untrust…6.3
• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63434MyTube is a self-hosted downloader and player for several vi…4.3
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-63436zt-zip is a Java library that provides convenience methods f…6.1
• CVE-2026-634372FAuth is a web app to manage Two-Factor Authentication (2FA…6.5
• CVE-2026-634382FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-634392FAuth is a web app to manage Two-Factor Authentication (2FA…9.8