# CVE-2026-63433: MyTube CSRF protection bypass via arbitrary API key header

Source: https://junglewise.ai/threats/cve-2026-63433-mytube-is-a-self-hosted-downloader-and-player-for-several-video  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-63433 · Severity: medium · CVSS 6.8 · Published 2026-11-03

MyTube is a self-hosted video downloader and player that manages a media library. A CSRF protection bypass flaw allows attackers to trick authenticated administrators into performing destructive operations—such as deleting videos, triggering unwanted downloads, or modifying subscriptions—by luring them to a malicious webpage when CORS is permissively configured. An attacker can forge requests with fake API keys that bypass token validation while being authenticated through the victim's session cookie.

Technologies: [Franklioxygen MyTube](https://junglewise.ai/threats/technologies/mytube). Vendors: [Franklioxygen](https://junglewise.ai/threats/vendors/franklioxygen).

## Quick answers

**Is CVE-2026-63433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63433 being exploited in the wild.

**How severe is CVE-2026-63433?** Medium severity, with a CVSS score of 6.8, published 3 November 2026.

**Which products and versions are affected?** Franklioxygen MyTube prior to 1.10.6.

**Is there a fix for CVE-2026-63433?** Yes: fixed in 1.10.6. Until then: Restrict CORS_ALLOWED_ORIGINS to a narrow allowlist of trusted origins rather than permissive values like "*"; do not use broad domain wildcards in cross-origin configurations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63433 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63433?** Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.6

Restrict CORS_ALLOWED_ORIGINS to a narrow allowlist of trusted origins rather than permissive values like "*"; do not use broad domain wildcards in cross-origin configurations.

## Technical details

The vulnerability exists in the CSRF middleware's shouldSkipCsrfProtection() function, which delegates to isApiKeyRequest() that checks only for the presence of an x-api-key or Authorization: ApiKey header without validating the key's actual value. This causes CSRF token validation to be skipped for any request bearing these headers, even with bogus values. An attacker can exploit this via a cross-origin request when CORS allows the attacker's origin, as the victim's session cookie authenticates the forged request after the CSRF gate has been opened.

## Affected products

- franklioxygen MyTube prior to 1.10.6

## Timeline

- 2026-07-01: disclosed
- 2026-11-03: advisory

## References

- [https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89](https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89)
- [https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r](https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r)

## Related threats

- [MyTube statistics data injection vulnerability](https://junglewise.ai/threats/cve-2026-63434-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube unauthenticated media access via static routes](https://junglewise.ai/threats/cve-2026-62302-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube insufficient role-based access control in video retrieval](https://junglewise.ai/threats/cve-2026-62301-mytube-is-a-self-hosted-downloader-and-player-for-several-video)