Is CVE-2026-62302 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62302 being exploited in the wild.

How severe is CVE-2026-62302?

Informational severity, published 30 October 2026.

Which products and versions are affected?

Franklioxygen MyTube prior to 1.10.3.

How is CVE-2026-62302 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-62302?

Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62302: MyTube unauthenticated media access via static routes

CVE-2026-62302 · Severity: info · Published 2026-10-30

MyTube is a self-hosted video downloader and player that can be configured to require login for multi-user deployments. Prior to version 1.10.3, when login is enabled, static media routes (videos, images, subtitles, avatars) are not protected by authentication, allowing an attacker to bypass the frontend login and directly download any stored video or media file without credentials.

Technologies: Franklioxygen MyTube. Vendors: Franklioxygen.

Quick answers

Is CVE-2026-62302 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62302 being exploited in the wild.
How severe is CVE-2026-62302?: Informational severity, published 30 October 2026.
Which products and versions are affected?: Franklioxygen MyTube prior to 1.10.3.
Is there a fix for CVE-2026-62302?: Yes: fixed in 1.10.3. Until then: Ensure loginEnabled=true deployments are upgraded to version 1.10.3. Single-user deployments with loginEnabled=false (the default) have no authentication boundary and cannot be hardened without architectural changes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62302 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-62302?: Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.10.3

Ensure loginEnabled=true deployments are upgraded to version 1.10.3. Single-user deployments with loginEnabled=false (the default) have no authentication boundary and cannot be hardened without architectural changes.

Technical details

The vulnerability stems from middleware registration order in Express: authentication middleware is mounted in registerApiRoutes(), but static media routes are registered first in registerStaticRoutes() and registerCloudRoutes(), leaving them completely unauthenticated even when loginEnabled=true. An unauthenticated attacker can directly access /videos/*, /images/*, /subtitles/*, /avatars/*, and cloud proxy routes (/cloud/videos/, /cloud/images/) by simple HTTP requests, bypassing the frontend login wall. Combined with hidden video path disclosure, this enables complete media exfiltration.

Affected products

franklioxygen MyTube prior to 1.10.3

Timeline

2026-06-26: disclosed: GHSA-rwwf-29mq-5j43 published
2026-06-25: patched: Fix committed
2026-10-30: advisory: CVE-2026-62302 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.