CVE-2026-63433

The record

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim's session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6.

Affected packages

Related vulnerabilities

• CVE-2026-110288 A cross-site request forgery vulnerability was identified in GitHub Enterprise Server… CWE-352
• CVE-2026-121451 AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in… CWE-352
• CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5… CWE-352
• CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request… CWE-352
• CVE-2026-120206 Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back… CWE-352
• CVE-2026-120207 Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that… CWE-352
• CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. CWE-352
• CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows… CWE-352