The flaw exists in the on_prepare function of the CORS Policy component of MeTube. Manipulation of this function causes the service to apply a permissive cross‑domain configuration, letting any origin—including untrusted domains—send requests that are treated as if they came from a trusted source. The result is that data from the API endpoints could be read or modified by an attacker, exposing sensitive information or enabling unintended data manipulation. The weakness is represented by CWE-346 and CWE-942.

The product affected is alexta69 MeTube. Any release up to and including 2026.04.09 is vulnerable. A patch that eliminates the issue is included in release 2026.04.10, identified by the commit hash 0072d3488ae5b8d922d3ee87458d829993742a32.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The attack vector is remote; an adversary could simply host a malicious web page that sends cross‑origin requests to the vulnerable service, leveraging the permissive CORS configuration to exfiltrate data.