MyTube, a self‑hosted downloader and player, allows unauthenticated users to craft an X‑Forwarded‑For header that convinces the application to treat the request as coming from a different IP. The application performs rate limiting solely on the client IP it sees, so by spoofing that header an attacker can send an unlimited number of requests to any rate‑limited API endpoint. The result is a denial‑of‑service scenario, with the ability to exhaust resources or prevent legitimate users from accessing the service.

The vulnerability exists in all releases of Franklioxygen MyTube up to and including version 1.7.70. Version 1.7.71 and later contain a patch that eliminates the rate‑limiting bypass.

The CVSS score is 6.5, indicating a medium level of severity. The EPSS score is below 1 %, suggesting a very small probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The attack vector requires only the ability to send HTTP requests with an arbitrary X‑Forwarded‑For header, so any unauthenticated victim could carry it out through a standard web server.