{"uuid": "4c339e76-8769-4db2-a0af-7ba45dc8c4c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-r44w-v6gf-x3p6", "type": "seen", "source": "https://gist.github.com/alon710/8005dd75fa3afcd22ac28cbc6a17e1be", "content": "# GHSA-R44W-V6GF-X3P6: Authentication Bypass in pyLoad API Key Caching Mechanism (GHSA-R44W-V6GF-X3P6)\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/GHSA-R44W-V6GF-X3P6\n\n## Summary\nAn authentication bypass vulnerability in pyLoad allows unauthenticated remote attackers to gain administrative API access. The vulnerability is caused by a logical flaw in the API key cache validation lookup, where authentication states are cached using only the public key identifier, skipping cryptographic token verification on cache hits.\n\n## TL;DR\nRemote attackers can bypass authentication in pyLoad and access administrative API endpoints by exploiting a logical flaw that caches authentication states using public key IDs instead of the private secret token.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.1\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Affected Package**: pyload-ng\n\n## Affected Systems\n\n- pyLoad (pyload-ng)\n- **pyload-ng**: < 0.5.0b3.dev101 (Fixed in: `0.5.0b3.dev101`)\n\n## Mitigation\n\n- Upgrade pyload-ng to version 0.5.0b3.dev101 or higher immediately.\n- Restrict access to the pyLoad API endpoints (/api/) to authorized network CIDRs via local firewalls or reverse proxy configuration.\n- Deploy external web application firewall (WAF) rules or reverse proxy authentication to intercept programmatic calls.\n\n**Remediation Steps:**\n1. Identify running containerized or localized instances of pyLoad.\n2. Run 'pip install --upgrade pyload-ng' to pull the latest security release.\n3. Verify the installed version is 0.5.0b3.dev101 or later.\n4. Restart the pyload daemon to purge active insecure caches.\n\n## References\n\n- [GitHub Advisory GHSA-R44W-V6GF-X3P6](https://github.com/advisories/GHSA-R44W-V6GF-X3P6)\n- [pyLoad Security Advisory GHSA-r44w-v6gf-x3p6](https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-R44W-V6GF-X3P6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T17:30:30.000000Z"}