Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-54254Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites
Medium 5.9
In plain English
A medium-severity improper input validation in cyberdrop-dl from Cyberdrop-DL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTED_DOMAINS, and then reuses that input host for API requests. When a Pixeldrain API key is configured, processing a crafted URL from an attacker-controlled lookalike host causes cyberdrop_dl/crawlers/pixeldrain.py to send the Authorization header to that host. The URL may be introduced through a third-party site that can cause downloads for other sites, and the attacker receives the user's Pixeldrain API key. This issue is fixed in version 9.14.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | cyberdrop-dl-patched | 9.14.0 | GHSA-f5pf-q7c7-m3vv |
| PyPI | cyberdrop-dl-patched | 9.14.0 | PYSEC-2026-3460 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cyberdrop-DL | cyberdrop-dl | >= 8.5.0, < 9.14.0 |
Weakness: CWE-20, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/Cyberdrop-DL/cyberdrop-dl/security/advisories/GHSA-f5pf-q7c7-m3vv x_refsource_CONFIRM
- https://github.com/Cyberdrop-DL/cyberdrop-dl/pull/1944 x_refsource_MISC
- https://github.com/Cyberdrop-DL/cyberdrop-dl/commit/4479555ae3f9d56d7657d6179a5bac3123eb4e2b x_refsource_MISC
- https://github.com/Cyberdrop-DL/cyberdrop-dl/releases/tag/9.14.0 x_refsource_MISC