affected:
- package:
    ecosystem: PyPI
    name: pyload-ng
    purl: pkg:pypi/pyload-ng
  ranges:
  - events:
    - introduced: '0'
    - fixed: 0.5.0b3.dev69
    type: ECOSYSTEM
  versions:
  - 0.5.0a5.dev528
  - 0.5.0a5.dev532
  - 0.5.0a5.dev535
  - 0.5.0a5.dev536
  - 0.5.0a5.dev537
  - 0.5.0a5.dev539
  - 0.5.0a5.dev540
  - 0.5.0a5.dev545
  - 0.5.0a5.dev562
  - 0.5.0a5.dev564
  - 0.5.0a5.dev565
  - 0.5.0a6.dev570
  - 0.5.0a6.dev578
  - 0.5.0a6.dev587
  - 0.5.0a7.dev596
  - 0.5.0a8.dev602
  - 0.5.0a9.dev615
  - 0.5.0a9.dev629
  - 0.5.0a9.dev632
  - 0.5.0a9.dev641
  - 0.5.0a9.dev643
  - 0.5.0a9.dev655
  - 0.5.0a9.dev806
  - 0.5.0b1.dev1
  - 0.5.0b1.dev2
  - 0.5.0b1.dev3
  - 0.5.0b1.dev4
  - 0.5.0b1.dev5
  - 0.5.0b2.dev10
  - 0.5.0b2.dev11
  - 0.5.0b2.dev12
  - 0.5.0b2.dev9
  - 0.5.0b3.dev13
  - 0.5.0b3.dev14
  - 0.5.0b3.dev17
  - 0.5.0b3.dev18
  - 0.5.0b3.dev19
  - 0.5.0b3.dev20
  - 0.5.0b3.dev21
  - 0.5.0b3.dev22
  - 0.5.0b3.dev24
  - 0.5.0b3.dev26
  - 0.5.0b3.dev27
  - 0.5.0b3.dev28
  - 0.5.0b3.dev29
  - 0.5.0b3.dev30
  - 0.5.0b3.dev31
  - 0.5.0b3.dev32
  - 0.5.0b3.dev33
  - 0.5.0b3.dev34
  - 0.5.0b3.dev35
  - 0.5.0b3.dev38
  - 0.5.0b3.dev39
  - 0.5.0b3.dev40
  - 0.5.0b3.dev41
  - 0.5.0b3.dev42
  - 0.5.0b3.dev43
  - 0.5.0b3.dev44
  - 0.5.0b3.dev45
  - 0.5.0b3.dev46
  - 0.5.0b3.dev47
  - 0.5.0b3.dev48
  - 0.5.0b3.dev49
  - 0.5.0b3.dev50
  - 0.5.0b3.dev51
  - 0.5.0b3.dev52
  - 0.5.0b3.dev53
  - 0.5.0b3.dev54
  - 0.5.0b3.dev57
  - 0.5.0b3.dev60
  - 0.5.0b3.dev62
  - 0.5.0b3.dev64
  - 0.5.0b3.dev65
  - 0.5.0b3.dev66
  - 0.5.0b3.dev67
  - 0.5.0b3.dev68
aliases:
- CVE-2026-40594
- GHSA-mp82-fmj6-f22v
details: "pyLoad is a free and open-source download manager written in Python. Prior\
  \ to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py\
  \ reads the X-Forwarded-Proto header from any HTTP request without validating that\
  \ the request originates from a trusted proxy, then mutates the global Flask configuration\
  \ SESSION_COOKIE_SECURE on every request. Because pyLoad uses the multi-threaded\
  \ Cheroot WSGI server (request_queue_size=512), this creates a race condition where\
  \ an attacker's request can influence the Secure flag on other users' session cookies\
  \ \u2014 either downgrading cookie security behind a TLS proxy or causing a session\
  \ denial-of-service on plain HTTP deployments. This vulnerability is fixed in 0.5.0b3.dev98."
id: PYSEC-2026-125
modified: '2026-05-20T09:19:15.897854Z'
published: '2026-04-21T18:16:51.553Z'
references:
- type: EVIDENCE
  url: https://github.com/pyload/pyload/security/advisories/GHSA-mp82-fmj6-f22v
severity:
- score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
  type: CVSS_V3