{"affected":[{"product":"pyload","source":"CNA: GitHub_M","vendor":"pyload","versions":[{"status":"affected","version":"< 0.5.0b3.dev101"}]}],"cveId":"CVE-2026-123816","cwes":["CWE-287"],"description":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner's permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794258948314,"publishedAt":1794258948314,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e"}],"remediation":[],"revision":"205207398e4251eca11d2c308b8ffa95e6e8bd09526d07337244db2a881db881","sources":[{"modifiedAt":1794258948314,"name":"CNA: GitHub_M","retrievedAt":1794262159693,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123816"}],"ssvc":null,"status":"published","title":"pyLoad: Authentication bypass in API key validation (check_apikey cache)","updatedAt":1794262159693}