Authentication Bypass by Primary Weakness Affecting pyload-ng package, versions [,0.5.0b3.dev101)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PYLOADNG-21427282
- published22 Oct 2026
- disclosed9 Oct 2026
- creditHussein Ali - Nirtem
Introduced: 9 Oct 2026
New CVE NOT AVAILABLE CWE-305 (opens in a new tab)How to fix?
Upgrade pyload-ng to version 0.5.0b3.dev101 or higher.
Overview
pyload-ng is a The free and open-source Download Manager written in pure Python
Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via an API key cache keyed on key_id instead of the full API key value in check_apikey. Because the cache is indexed by the integer key_id rather than the full API key string, a request presenting any API key that shares a key_id with a previously validated key can receive a cache hit and be treated as authenticated without the actual key value being verified against the database.