Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33511pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in pyload from pyload. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

Affected products (as reported)

Vendor	Product	Versions
pyload	pyload	>= 0.4.20, < 0.5.0b3.dev97

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N

References

https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw x_refsource_CONFIRM