Authorization Bypass in pyLoad Download Manager

CVE-2026-123816

What is CVE-2026-123816?

pyLoad, an open-source download manager, has a vulnerability where API key validation is inadequately secured. Before version 0.5.0b3.dev101, an attacker can exploit the caching mechanism of the API check, which relies solely on the key_id, allowing for an unauthorized entity to inherit permissions of the cached key owner. This occurs due to the absence of a comparative hash check on the API key after its successful validation. As key identifiers are sequential integers, an attacker may enumerate through active identifiers within a specified cache lifetime, potentially leading to unauthorized access.

References