Insufficient Session Expiration Affecting pyload-ng package, versions [0,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PYLOADNG-21693779
- published24 Oct 2026
- disclosed9 Oct 2026
- creditArpit Jain
Introduced: 9 Oct 2026
New CVE NOT AVAILABLE CWE-613 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
A fix was pushed into the master branch but not yet published.
Overview
pyload-ng is a The free and open-source Download Manager written in pure Python
Affected versions of this package are vulnerable to Insufficient Session Expiration via the change_password, remove_user, and set_user_permission API methods, which fail to invalidate existing web sessions when a user's credentials or permissions are changed. An authenticated attacker whose password has been changed or whose account has been removed can continue to use their old session token to access the application with their previous privilege level.