CVE-2026-62302

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.10.3

Description In server.ts, the functions registerStaticRoutes and registerCloudRoutes are called before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Since Express processes middleware in the order they are registered, the routes in staticRoutes.ts and cloudRoutes.ts bypass the authentication stack even when loginEnabled is set to true. This allows unauthenticated clients to access local videos via the '/videos/' endpoint, thumbnails via '/images/' and '/images-small/', avatars via '/avatars/', subtitles via '/subtitles/', cloud thumbnail caches via '/api/cloud/thumbnail-cache/', and cloud signed URLs or redirects via '/cloud/videos/:filename' and '/cloud/images/:filename'. This flaw enables the unauthenticated download of hidden media when combined with hidden-video path leaks.

Recommendations Update to version 1.10.3.