CVE-2026-54254

Name of the Vulnerable Software and Affected Versions cyberdrop-dl-patched versions prior to 9.14.0

Description When processing Pixeldrain URLs, the software may send an Authorization header containing the user's API key to unverified hosts. This occurs because the application matches URLs to a crawler if the host contains a supported host as a sub-string rather than an exact match. Consequently, a malicious domain that mimics a supported host can trigger the Pixeldrain crawler, causing the application to send API requests to the malicious host and leak the API key.

Recommendations Update to version 9.14.0. Delete and regenerate any Pixeldrain API keys used with the software, as they should be considered compromised.