The flaw resides in the roleBasedAuthMiddleware of MyTube, where unauthenticated requests are allowed to proceed to downstream handlers. An attacker who omits the authentication cookie can cause the middleware to treat req.user as undefined and simply call next(), thereby bypassing the mandatory authentication check. As a result, the attacker can access and modify application settings through /api/settings, change administrative and visitor passwords, and consume any protected routes that depend on this middleware. This is a classic authorization bypass based on missing access control checks (CWE-863).

The vulnerability affects the FrankLioxygen MyTube application, specifically versions 1.7.65 and earlier. Any instance that runs with loginEnabled set to true is impacted regardless of the exact version number, until the middleware is patched. The defect was fixed in the 1.7.66 release.

The CVSS base score of 9.8 marks this as Critical, while the EPSS score of less than 1% indicates that exploitation attempts are expected to be rare but possible. The vulnerability is not currently listed in the CISA KEV catalog, yet the lack of authentication enforcement makes remote exploitation straightforward: an unauthenticated user can issue requests to any protected API endpoint via an open network connection. The attacker has full control over settings and credentials once the bypass is achieved. High severity combined with low but non-zero exploit probability means that administrators should act promptly.