CVE-2026-123816
pyLoad: Authentication bypass in API key validation (check_apikey cache)
Description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner's permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101.
INFO
Published Date :
Nov. 9, 2026, 9:15 p.m.
Last Modified :
Nov. 9, 2026, 9:15 p.m.
Remotely Exploit :
Yes !
Source :
GitHub_M
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update pyLoad to a fixed version.
- Apply patches if updating is not possible.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-123816 vulnerability anywhere in the article.