I was able to fix this with Cloudflare until it’s officially patched.
For anyone running into the same issue, the cause is that YouTube now rejects embed requests missing a valid referrer policy header.
I added a Referrer-Policy header through Cloudflare’s Transform Rules (no Workers needed).
Here’s what I did:
-
In Cloudflare, go to Rules → Transform Rules → HTTP Response Header Modification.
-
Create a new rule, choose All incoming requests, and add a static header:
Header name: Referrer-Policy Value: strict-origin-when-cross-origin -
Deploy the rule.
Will remove this once patched.