# CVE-2026-62302: MyTube unauthenticated media access via static routes

Source: https://junglewise.ai/threats/cve-2026-62302-mytube-is-a-self-hosted-downloader-and-player-for-several-video  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-62302 · Severity: info · Published 2026-10-30

MyTube is a self-hosted video downloader and player that can be configured to require login for multi-user deployments. Prior to version 1.10.3, when login is enabled, static media routes (videos, images, subtitles, avatars) are not protected by authentication, allowing an attacker to bypass the frontend login and directly download any stored video or media file without credentials.

Technologies: [Franklioxygen MyTube](https://junglewise.ai/threats/technologies/mytube). Vendors: [Franklioxygen](https://junglewise.ai/threats/vendors/franklioxygen).

## Quick answers

**Is CVE-2026-62302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62302 being exploited in the wild.

**How severe is CVE-2026-62302?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Franklioxygen MyTube prior to 1.10.3.

**Is there a fix for CVE-2026-62302?** Yes: fixed in 1.10.3. Until then: Ensure loginEnabled=true deployments are upgraded to version 1.10.3. Single-user deployments with loginEnabled=false (the default) have no authentication boundary and cannot be hardened without architectural changes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62302 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62302?** Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.3

Ensure loginEnabled=true deployments are upgraded to version 1.10.3. Single-user deployments with loginEnabled=false (the default) have no authentication boundary and cannot be hardened without architectural changes.

## Technical details

The vulnerability stems from middleware registration order in Express: authentication middleware is mounted in registerApiRoutes(), but static media routes are registered first in registerStaticRoutes() and registerCloudRoutes(), leaving them completely unauthenticated even when loginEnabled=true. An unauthenticated attacker can directly access /videos/*, /images/*, /subtitles/*, /avatars/*, and cloud proxy routes (/cloud/videos/, /cloud/images/) by simple HTTP requests, bypassing the frontend login wall. Combined with hidden video path disclosure, this enables complete media exfiltration.

## Affected products

- franklioxygen MyTube prior to 1.10.3

## Timeline

- 2026-06-26: disclosed: GHSA-rwwf-29mq-5j43 published
- 2026-06-25: patched: Fix committed
- 2026-10-30: advisory: CVE-2026-62302 published

## References

- [https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456](https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456)
- [https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43](https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43)

## Related threats

- [MyTube statistics data injection vulnerability](https://junglewise.ai/threats/cve-2026-63434-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube CSRF protection bypass via arbitrary API key header](https://junglewise.ai/threats/cve-2026-63433-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube insufficient role-based access control in video retrieval](https://junglewise.ai/threats/cve-2026-62301-mytube-is-a-self-hosted-downloader-and-player-for-several-video)