CVE-2026-23848 MEDIUM

CVE-2026-23848: MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing

Vendor Franklioxygen

Product MyTube

Weakness CWE-807

Published January 19, 2026

Last update January 20, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

What the vulnerability does

01Description

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing allows unauthenticated attackers to bypass IP-based rate limiting on general API endpoints. Attackers can spoof client IPs by manipulating the `X-Forwarded-For` header, enabling unlimited requests to protected endpoints, including general API endpoints (enabling DoS) and other rate-limited functionality. Version 1.7.71 contains a patch for the issue.

Key dates

02Disclosure timeline

January 19, 2026 CVE published

January 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-23848 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/807.html