Vulnerability · Published May 1, 2026 · Assigned by VulDB

CVE-2026-7581alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy

Medium 4.3

In plain English

A medium-severity security flaw in MeTube from alexta69. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 93.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of the file app/main.py of the component CORS Policy. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.04.10 is able to mitigate this issue. The identifier of the patch is 0072d3488ae5b8d922d3ee87458d829993742a32. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
alexta69	MeTube	2026.04.09

Weakness: CWE-942, CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References

VDB-360528 | alexta69 MeTube CORS Policy main.py on_prepare cross-domain policy vdb-entry, technical-description
VDB-360528 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #801529 | alexta69 MeTube 2026.04.09 Permissive Cross-domain Policy with Untrusted Domains third-party-advisory
https://github.com/az10b/security-advisories/blob/main/cors_MeTube.md exploit
https://github.com/alexta69/metube/pull/949 issue-tracking, patch
https://github.com/alexta69/metube/commit/0072d3488ae5b8d922d3ee87458d829993742a32 patch
https://github.com/alexta69/metube/releases/tag/2026.04.10 patch
https://github.com/alexta69/metube/ product