PT-2026-3501 · Mytube · Mytube

P1Ngul1N0 · Published 2026-01-19 · Updated 2026-02-02 · CVE-2026-23848

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.7.71

Description MyTube is a self-hosted downloader and player for several video websites. A rate limiting bypass exists due to X-Forwarded-For header spoofing, allowing unauthenticated attackers to circumvent IP-based rate limiting on general API endpoints. Attackers can manipulate the X-Forwarded-For header to spoof client IPs, enabling unlimited requests to protected endpoints, including general API endpoints, potentially leading to a denial-of-service (DoS) condition. The vulnerable API endpoints are susceptible to abuse through the manipulation of the X-Forwarded-For header.

Recommendations Update MyTube to version 1.7.71 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2026-23848

GHSA-59GR-529G-X45H

Affected Products

Mytube

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23848.json · Exploit
• 🔥 https://github.com/franklioxygen/MyTube/security/advisories/GHSA-59gr-529g-x45h · Exploit
• https://github.com/franklioxygen/MyTube/commit/bc057458804ae7ac70ea00605680512ed3d4257b · Patch
• https://osv.dev/vulnerability/CVE-2026-23848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23848 · Security Note
• https://twitter.com/CVEnew/status/2013355087075201217 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013395984491978774 · Twitter Post
• https://t.me/cveNotify/150555 · Telegram Post