Insufficient Session Expiration Affecting pyload-ng package, versions [0.5.0b3.dev98,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PYLOADNG-21693783
- published24 Oct 2026
- disclosed9 Oct 2026
- creditFlowOverFail
Introduced: 9 Oct 2026
New CVE NOT AVAILABLE CWE-613 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
pyload-ng is a The free and open-source Download Manager written in pure Python
Affected versions of this package are vulnerable to Insufficient Session Expiration via the change_password, remove_user, and set_user_permission API methods, which fail to invalidate existing web sessions when a user's credentials or permissions are changed. An authenticated attacker whose password has been changed, whose account has been removed, or whose permissions have been downgraded retains full access through their existing session until it naturally expires.