CVE-2026-33314CWE-287CWE-346

pyload-ng: Improper Authentication and Origin Validation Error

Medium · published March 24, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the Click'N'Load API endpoints, enabling attackers to remotely queue arbitrary downloads, leading to Server-Side Request Forgery (SSRF) and Denial of Service (DoS). This issue has been patched in version 0.5.0b3.dev97.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-346 · Origin Validation Error
Published
2026-03-24T18:52Z
EPSS history
Timeline
  • 24 MAR 18:52Z
    pyload-ng: Improper Authentication and Origin Validation Error
    cvelistv5