# CVE-2026-63434: MyTube statistics data injection vulnerability

Source: https://junglewise.ai/threats/cve-2026-63434-mytube-is-a-self-hosted-downloader-and-player-for-several-video  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-63434 · Severity: medium · CVSS 4.3 · Published 2026-11-03

MyTube is a self-hosted video downloader and player that includes a statistics tracking feature for administrators. Prior to version 1.10.6, an unauthenticated visitor could inject fabricated analytics data by submitting false platform names, source types, and session identifiers, corrupting the statistics dashboards that administrators rely on to understand usage patterns. This allows attackers to create misleading reports about which video platforms are most popular or which download sources are most used.

Technologies: [Franklioxygen MyTube](https://junglewise.ai/threats/technologies/mytube). Vendors: [Franklioxygen](https://junglewise.ai/threats/vendors/franklioxygen).

## Quick answers

**Is CVE-2026-63434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63434 being exploited in the wild.

**How severe is CVE-2026-63434?** Medium severity, with a CVSS score of 4.3, published 3 November 2026.

**Which products and versions are affected?** Franklioxygen MyTube before 1.10.6.

**Is there a fix for CVE-2026-63434?** Yes: fixed in 1.10.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63434 attacked?** It is in a web application.

**Am I affected by CVE-2026-63434?** Check whether you run Franklioxygen MyTube at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.10.6

## Technical details

The vulnerability is an input validation failure in the statistics ingest endpoint (ingestEvents handler) where client-supplied platform, sourceKind, and sessionId fields are accepted without validation or server-side derivation before being persisted. An attacker with visitor role can forge arbitrary analytics events by manipulating these fields. The fix in version 1.10.6 derives the session identifier from the verified user identity (req.user.id) rather than accepting it from client input.

## Affected products

- franklioxygen MyTube before 1.10.6

## Timeline

- 2026-11-03: disclosed

## References

- [https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7](https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7)
- [https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66](https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66)

## Related threats

- [MyTube CSRF protection bypass via arbitrary API key header](https://junglewise.ai/threats/cve-2026-63433-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube unauthenticated media access via static routes](https://junglewise.ai/threats/cve-2026-62302-mytube-is-a-self-hosted-downloader-and-player-for-several-video)
- [MyTube insufficient role-based access control in video retrieval](https://junglewise.ai/threats/cve-2026-62301-mytube-is-a-self-hosted-downloader-and-player-for-several-video)