CVE-2026-62302

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in registration order, staticRoutes.ts and cloudRoutes.ts remain outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access local videos through /videos/*, thumbnails through /images/* and /images-small/*, avatars through /avatars/*, subtitles through /subtitles/*, cloud thumbnail caches through /api/cloud/thumbnail-cache/*, and cloud signed URLs or redirects through /cloud/videos/:filename and /cloud/images/:filename. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.