CVE-2026-63434

The record

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6.

Affected packages

Related vulnerabilities

• CVE-2026-116654 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
• CVE-2026-116653 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
• CVE-2026-121240 Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
• CVE-2026-121242 Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed… CWE-20
• CVE-2026-121236 Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
• CVE-2026-121163 Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
• CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
• CVE-2026-121115 Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20