MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access a

The impact of CVE-2026-23837 is significant. An attacker exploiting this vulnerability can directly access and modify the /api/settings endpoint without authentication. This allows them to alter application configurations, change administrative and visitor passwords, and potentially gain complete control over the MyTube instance. The lack of authentication enforcement means any user who can send HTTP requests to the MyTube server is potentially vulnerable. This bypass circumvents the intended security measures designed to protect sensitive data and administrative functions, creating a high-risk scenario for data breaches and unauthorized modifications.

Organizations and individuals running MyTube with loginEnabled: true are at significant risk. This includes those deploying MyTube in shared hosting environments, as the vulnerability can be exploited remotely without requiring local access. Legacy configurations that haven't been updated recently are also particularly vulnerable.

• nginx / server:

# Check access logs for requests to /api/settings without a valid authentication cookie
grep "/api/settings" /var/log/nginx/access.log | grep -v "Cookie:"

• generic web:

# Check response headers for unexpected behavior when accessing /api/settings without authentication
curl -I http://your-mytube-instance/api/settings

1. 2026-01-19Disclosure

   disclosure

1. 予約済み2026-01-16
2. 公開日2026-01-19
3. 更新日2026-02-02
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-23837 is to upgrade MyTube to a patched version. As of the publication date, a specific fixed version is not provided, so it is crucial to monitor the MyTube project's official channels for updates. In the interim, consider implementing a Web Application Firewall (WAF) rule to block requests to /api/settings without a valid authentication cookie. Additionally, carefully review and restrict access to the MyTube server to minimize the potential attack surface. Verify the upgrade by attempting to access /api/settings without providing an authentication cookie after the upgrade; access should be denied.