CVE-2026-63434

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.10.6

Description When statisticsEnabled and statisticsTrackVisitorActivity are enabled, a user with a visitor role can submit fabricated events to the statistics ingest endpoint handled by the ingestEvents() function in backend/src/controllers/statisticsController.ts. The handler processes req.body.events and accepts the platform, sourceKind, and sessionId variables without server-side validation. This allows a visitor to attribute fake events to arbitrary platforms, sources, and sessions, which corrupts administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics.

Recommendations Update to version 1.10.6. As a temporary mitigation, disable the statisticsEnabled or statisticsTrackVisitorActivity settings.