CVE-2026-123816 pyLoad: Authentication bypass in API key validation (check_apikey cache)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123816?
CVE-2026-123816 is a high-severity vulnerability in pyload, published on 9 Nov 2026.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner's permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101.
Weakness: CWE-287
Which versions are affected by CVE-2026-123816?
1 open source package ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
How do I fix CVE-2026-123816?
Upgrade pyload-ng to 0.5.0b3.dev101 or later.
Is CVE-2026-123816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123816 exists.
Sources
Also known as GHSA-r44w-v6gf-x3p6.