A mass assignment vulnerability exists in the settings management function of MyTube, where the application’s saveSettings() method accepts arbitrary key‑value pairs without filtering them against an allowed list. The effect is that any setting sent by an attacker is persisted directly to the database, allowing alteration of application behavior through unauthorized configuration changes. This weakness can lead to unintended functionality or data exposure and is identified as CWE‑915.

The flaw affects the open‑source video downloader and player MyTube by franklioxygen, specifically all versions before 1.7.78. Version 1.7.78 and later contain a fix for the issue.

The CVSS score of 2.7 indicates low to moderate severity, and the EPSS score of less than 1% signals a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. As the flaw is tied to the settings API, the likely attack vector is via authenticated users submitting arbitrary configuration data, although the exact method is not detailed in the advisory and is inferred from the API design.