CVE-2026-123816— pyLoad: Authentication bypass in API key validation (check_apikey cache)

Quick assessment

Affected

pyload pyload

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyLoad 是一款用 Python 编写的免费开源下载管理器。在版本 0.5.0b3.dev101 之前，方法在缓存成功验证结果时，仅使用由攻击者控制的作为缓存键，将结果存入。当合法密钥首次填充缓存后，攻击者可构造一个具有相同的伪造 API 密钥，使其直接命中缓存路径，而无需通过将与存储的哈希值进行比对。由于密钥标识符是小型的连续整数，未认证的远程攻击者可以枚举出当前有效的标识符，并在 300 秒的缓存有效期内继承原密钥持有者的权限。该问题已在版本 0.5.0b3.dev101 中修复。

CVSS 8.1 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1538 · Cloud Service Dashboard T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pyLoad: Authentication bypass in API key validation (check_apikey cache)

Source: CVE Program / CVE List V5

Vulnerability Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner's permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pyload	pyload	< 0.5.0b3.dev101	-

II. Public POCs for CVE-2026-123816

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123816

请登录查看更多情报信息。

Other References for CVE-2026-123816 (2)

https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6 x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-123816

Same Patch Batch · pyload · 2026-11-09 · 4 CVEs total

CVE-2026-123815	9.4 CRITICAL	pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile
CVE-2026-123813	7.5 HIGH	pyLoad: Privilege revocation and password change through the REST API do not invalidate th
CVE-2026-123814	6.4 MEDIUM	pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.

IV. Related Vulnerabilities

Same product: pyload

Same vendor: pyload

Same weakness: CWE-287