CVE-2026-123816

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev101

Description An authentication bypass exists in the API-key cache mechanism. The Api.check apikey() function caches successful validations in self. apikey cache using only the key id, which is a small sequential integer provided by the user. When a cache hit occurs within the 300-second cache lifetime, the system returns a success response without verifying the API key secret against the stored hash using hmac.compare digest(). An unauthenticated remote attacker can enumerate active key id values and use a forged API key to inherit the permissions of the cached key owner.

Recommendations Update pyLoad to version 0.5.0b3.dev101 or later.