CVE-2026-123816

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.checkapikey caches successful validation in self.apikeycache using only the attacker-controlled keyid. After a legitimate key populates the cache, a forged API key with the same keyid reaches the...

CVE-2026-123816

The open-source download manager pyLoad contains a critical authentication bypass in its API key validation mechanism (versions prior to 0.5.0b3.dev101 ). The root cause is that the Api.check_apikey() function caches successful validations in self._apikey_cache using only the key_id, which is a s...

EUVD-2026-120452

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.checkapikey caches successful validation in self.apikeycache using only the attacker-controlled keyid. After a legitimate key populates the cache, a forged API key with the same keyid reaches the...

CVE-2026-123816: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.checkapikey caches successful validation in self.apikeycache using only the attacker-controlled keyid. After a legitimate key populates the cache, a forged API key with the same keyid reaches the...

GHSA-R44W-V6GF-X3P6 pyLoad has an authentication bypass in API key validation (check_apikey cache)

Summary The API-key cache in checkapikey allows an attacker to authenticate with a forged API key as long as the legitimate key for the same keyid has been used recently. On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetime...