CVE-2026-63433

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.10.6

Description An issue exists where the shouldSkipCsrfProtection() function in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a Cross-Site Request Forgery (CSRF) exemption based solely on the presence of an x-api-key header or an Authorization: ApiKey value, without performing actual API-key validation. When a permissive CORS ALLOWED ORIGINS configuration is used, an unauthenticated attacker can trick an authenticated administrator into visiting malicious content. This allows the attacker to send cross-origin state-changing requests using an arbitrary API-key value. Because the victim's session cookie authenticates the request and CSRF validation is bypassed, the attacker can perform administrative operations such as deleting media, triggering downloads, or modifying subscriptions.

Recommendations Update to version 1.10.6.