{"id":"CVE-2026-123816","published":"2026-11-09T22:18:38.110","lastModified":"2026-11-10T17:17:24.393","description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner's permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6","tags":[]}],"exploitRefs":[{"url":"https://github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6","tags":[]},{"url":"https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6","tags":[]}],"hasPoc":true,"ai":null}