pyLoad has an authentication bypass in API key validation (check_apikey cache)

Summary The API-key cache in checkapikey allows an attacker to authenticate with a forged API key as long as the legitimate key for the same keyid has been used recently. On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetime...

Authentication Bypass by Primary Weakness

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via an API key cache keyed on keyid instead of the full API key value in checkapikey. Because the cache is indexed...