# CVE-2026-123814: pyLoad WindowsPhoneNotify SSRF in notification addon

Source: https://junglewise.ai/threats/cve-2026-123814-pyload-is-a-free-and-open-source-download-manager-written-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-123814 · Severity: medium · CVSS 6.4 · Published 2026-11-09

pyLoad is a download manager that allows users to configure notifications when downloads complete. A non-admin user with basic settings permissions can trick the application into sending HTTP requests to internal servers—such as cloud metadata endpoints or private services—that they should not be able to reach. This allows an attacker to probe internal networks, access sensitive cloud credentials, or trigger unintended state changes on internal services.

Technologies: [pyLoad](https://junglewise.ai/threats/technologies/pyload). Vendors: [pyLoad](https://junglewise.ai/threats/vendors/pyload).

## Quick answers

**Is CVE-2026-123814 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123814 being exploited in the wild.

**How severe is CVE-2026-123814?** Medium severity, with a CVSS score of 6.4, published 9 November 2026.

**Which products and versions are affected?** pyLoad before 0.5.0b3.dev102.

**Is there a fix for CVE-2026-123814?** Yes: fixed in 0.5.0b3.dev102. Until then: Disable or remove the WindowsPhoneNotify and AndroidPhoneNotify addons if not in use; restrict the SETTINGS permission to trusted users only, or upgrade to version 0.5.0b3.dev102 where these notification plugins have been removed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123814 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123814?** Check whether you run pyLoad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.5.0b3.dev102

Disable or remove the WindowsPhoneNotify and AndroidPhoneNotify addons if not in use; restrict the SETTINGS permission to trusted users only, or upgrade to version 0.5.0b3.dev102 where these notification plugins have been removed.

## Technical details

A server-side request forgery (SSRF) vulnerability in the WindowsPhoneNotify addon allows an authenticated non-admin user with SETTINGS permission to configure arbitrary notification endpoints via the /json/save_config API. The addon uses http.client.HTTPConnection to send POST requests to a user-controlled host and path (pushurl and pushid), bypassing pyLoad's pycurl-based outbound SSRF validation that normally restricts requests to global addresses. When any download completes, the global notification event triggers a blind POST to the attacker's chosen internal destination.

## Affected products

- pyLoad pyLoad before 0.5.0b3.dev102

## Timeline

- 2026-09-26: disclosed
- 2026-11-09: advisory

## References

- [https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559](https://github.com/pyload/pyload/commit/989a551d2ae0c00b0d2c7baf6d850180c9b46559)
- [https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8](https://github.com/pyload/pyload/security/advisories/GHSA-p3pr-8f3m-4qp8)

## Related threats

- [pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in)
- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)