CVE-2026-62302

{
  "etk_id": "ETK-2026-3109",
  "cve_id": "CVE-2026-62302",
  "display_id": "CVE-2026-62302",
  "ghsa_id": "GHSA-rwwf-29mq-5j43",
  "euvd_id": "EUVD-2026-114369",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass exposes media in MyTube",
  "summary": "MyTube versions before 1.10.3 can serve media resources without applying configured login checks. An unauthenticated remote client may retrieve local media and related assets, and may access cloud media resources when cloud storage is configured, in deployments with login enabled.",
  "mitigation": "Upgrade MyTube to version 1.10.3 or later. Until the update is applied, restrict network access to the service and avoid exposing it to untrusted clients.",
  "vendor": "franklioxygen",
  "product": "MyTube",
  "affected": [
    {
      "affected_notes": [
        "≤ v1.10.2"
      ],
      "affected_ranges": [],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "MyTube",
      "purl": "pkg:npm/MyTube"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 50.836794,
  "t0_at": "2026-10-30T19:29:46.456000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-30T21:01:57.848938+00:00",
      "days": 0.06402075159722222,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T19:29:46.456000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-06-26T14:44:37+00:00",
      "days": -126.1980261111111,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T19:29:46.456000+00:00",
      "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43"
    },
    "trigger_signal": {
      "at": "2026-10-30T19:29:46.456000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T19:29:46.456000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62302"
    }
  }
}