Franklioxygen vulnerabilities
We track 6 vulnerabilities in Franklioxygen products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Franklioxygen vulnerabilities
- 8.7 High severity
MyTube: Missing Authentication for Critical Functionality
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted.
- 7.1 High severity
MyTube: Missing Authorization
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The fron
- 7.5 High severity
MyTube: Improper Restriction of Excessive Authentication Attempts
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based authentication by triggering failed login attempts. The applicatio
- 9.8 Critical severity
MyTube: Improper Access Control
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passke
- 8.8 High severity
MyTube: Improper Authorization
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database` endpoint allows attackers with low-privilege credentials to upload and replace the application's SQ
- 9.8 Critical severity
MyTube: Incorrect Authorization
MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By si