Is CVE-2026-63434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63434 being exploited in the wild.

How severe is CVE-2026-63434?

Medium severity, with a CVSS score of 4.3, published 3 November 2026.

Which products and versions are affected?

Franklioxygen MyTube before 1.10.6.

Is there a fix for CVE-2026-63434?

Yes: fixed in 1.10.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-63434?

Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63434: MyTube statistics data injection vulnerability

CVE-2026-63434 · Severity: medium · CVSS 4.3 · Published 2026-11-03

MyTube is a self-hosted video downloader and player that includes a statistics tracking feature for administrators. Prior to version 1.10.6, an unauthenticated visitor could inject fabricated analytics data by submitting false platform names, source types, and session identifiers, corrupting the statistics dashboards that administrators rely on to understand usage patterns. This allows attackers to create misleading reports about which video platforms are most popular or which download sources are most used.

Technologies: Franklioxygen MyTube. Vendors: Franklioxygen.

Quick answers

Is CVE-2026-63434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63434 being exploited in the wild.
How severe is CVE-2026-63434?: Medium severity, with a CVSS score of 4.3, published 3 November 2026.
Which products and versions are affected?: Franklioxygen MyTube before 1.10.6.
Is there a fix for CVE-2026-63434?: Yes: fixed in 1.10.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63434 attacked?: It is in a web application.
Am I affected by CVE-2026-63434?: Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.10.6

Technical details

The vulnerability is an input validation failure in the statistics ingest endpoint (ingestEvents handler) where client-supplied platform, sourceKind, and sessionId fields are accepted without validation or server-side derivation before being persisted. An attacker with visitor role can forge arbitrary analytics events by manipulating these fields. The fix in version 1.10.6 derives the session identifier from the verified user identity (req.user.id) rather than accepting it from client input.

Affected products

franklioxygen MyTube before 1.10.6

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.