CVE-2026-40594 pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Attackers can spoof headers to trigger a race condition that downgrades session cookie security or causes denial of service in pyLoad.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40594?
CVE-2026-40594 is a medium-severity vulnerability in pyload, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the global Flask configuration SESSION_COOKIE_SECURE on every request. Because pyLoad uses the multi-threaded Cheroot WSGI server (request_queue_size=512), this creates a race condition where an attacker's request can influence the Secure flag on other users' session cookies — either downgrading cookie security behind a TLS proxy or causing a session denial-of-service on plain HTTP deployments. This vulnerability is fixed in 0.5.0b3.dev98.
Weakness: CWE-346
Which versions are affected by CVE-2026-40594?
3 open source packages ship an affected version, including pyload-ng. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions | 0.5.0b3.dev69 |
pyload-ng PyPI | All versions | 0.5.0b3.dev98 |
pyload-ng PyPI | All versions | 0.5.0b3.dev98 |
Products include Pyload-Ng Project Pyload-Ng.
How do I fix CVE-2026-40594?
Upgrade pyload-ng to a fixed version for your release line: 0.5.0b3.dev69 or 0.5.0b3.dev98.
Is CVE-2026-40594 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40594 exists.
Other vulnerabilities in pyload
- CVE-2025-54802 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)
- CVE-2024-22416 Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
- CVE-2023-0488 Cross-site Scripting (XSS) - Stored in pyload/pyload
- CVE-2026-35459 pyLoad has SSRF fix bypass via HTTP redirect
- CVE-2026-35463 pyLoad has Improper Neutralization of Special Elements used in an OS Command
Sources
Also known as GHSA-mp82-fmj6-f22v, PYSEC-2026-125.