User Impersonation Affecting pyload-ng package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PYLOADNG-21427286
- published22 Oct 2026
- disclosed9 Oct 2026
- creditHussein Ali - Nirtem
Introduced: 9 Oct 2026
New CVE NOT AVAILABLE CWE-290 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
pyload-ng is a The free and open-source Download Manager written in pure Python
Affected versions of this package are vulnerable to User Impersonation via the X-Forwarded-For header in the login endpoint of the web UI. The application reads the first value of the X-Forwarded-For header to determine the client IP address without validating whether the request actually passed through a trusted proxy, allowing an unauthenticated attacker to spoof their IP address by supplying an arbitrary value in that header.
Note: This is only exploitable when pyload is not deployed behind a trusted reverse proxy configured via the trusted_proxies setting.