Critical · published January 19, 2026
🚨 A sneaky gap in MyTube lets anyone skip the login and run amok—no authentication cookie needed! 🔥 Think of it like a party where the bouncers have decided to let anyone in without checking IDs, allowing uninvited guests to mess with the music playlist and even rearrange the furniture! 🎉 This vulnerability is absolutely devastating! An attacker can not only access sensitive application settings but also modify passwords for both admins and visitors, effectively taking over your MyTube instance. With unauthorized access to `/api/settings`, they could wreak havoc on your video platform, leaving you in a chaotic mess of user accounts and settings. 😱
Think of it like a party where the bouncers have decided to let anyone in without checking IDs, allowing uninvited guests to mess with the music playlist and even rearrange the furniture! 🎉 The flaw in MyTube's roleBasedAuthMiddleware allows unauthenticated users to pass through checks erroneously, resulting in requests being processed even without valid authentication credentials. This creates a significant security risk for all users running version 1.7.65 and earlier with loginEnabled set to true.
This vulnerability is absolutely devastating! An attacker can not only access sensitive application settings but also modify passwords for both admins and visitors, effectively taking over your MyTube instance. With unauthorized access to `/api/settings`, they could wreak havoc on your video platform, leaving you in a chaotic mess of user accounts and settings. 😱 Upgrade MyTube to version 1.7.66 immediately to close this vulnerability. If you can't upgrade right now, shut off access to `/api/` endpoints using a firewall or reverse proxy like Nginx, allowing only trusted IP addresses. Alternatively, you can manually patch the middleware to return a 401 Unauthorized error when `req.user` is undefined. 🛡️ You've got this! By taking these steps, you'll turn this potential crisis into a well-secured setup in no time! 💪✨