GHSA-r44w-v6gf-x3p6: pyLoad has an authentication bypass in API key validation (check_apikey cache)

October 9, 2026

The API-key cache in check_apikey() allows an attacker to authenticate with a forged API key as long as the legitimate key for the same key_id has been used recently.

On a cache hit, the API key secret is never verified, resulting in a complete authentication bypass during the cache lifetime.

References

github.com/advisories/GHSA-r44w-v6gf-x3p6
github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e
github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6

Code Behaviors & Features

Detect and mitigate GHSA-r44w-v6gf-x3p6 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →