# CVE-2026-33314: pyload-ng auth bypass via Host header spoofing in Click'N'Load API

Source: https://junglewise.ai/threats/cve-2026-33314-pyload-ng-auth-bypass-via-host-header-spoofing-in-click-n-load  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-33314 · Severity: medium · CVSS 6.5 · Published 2026-03-19

A security flaw in pyload-ng, a popular download management tool, allows remote attackers to bypass security checks intended to restrict certain features to local users. By tricking the system into thinking a request is coming from the local machine, an attacker can remotely add unauthorized files to the download queue. This can lead to the server being used to attack other systems or being overwhelmed by massive, unwanted downloads.

Technologies: [pyload-ng (PyPI)](https://junglewise.ai/threats/technologies/pyload-ng). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33314 being exploited in the wild.

**How severe is CVE-2026-33314?** Medium severity, with a CVSS score of 6.5, published 19 March 2026.

**Which products and versions are affected?** pyload-ng (PyPI) <= 0.5.0b3.dev96, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev97.

**Is there a fix for CVE-2026-33314?** Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33314 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33314?** Check whether you run pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyload-ng (PyPI): upgrade to 0.5.0b3.dev97 or later

  ```sh
  pip install "pyload-ng>=0.5.0b3.dev97"
  ```


## Technical details

A Host Header Spoofing vulnerability exists in the `@local_check` decorator within `src/pyload/webui/app/blueprints/cnl_blueprint.py`. The implementation incorrectly trusts the user-controlled `HTTP_HOST` header to verify if a request originated from localhost. An unauthenticated remote attacker can bypass this check by providing a spoofed header (e.g., `Host: 127.0.0.1:9666`), gaining access to protected Click'N'Load API endpoints such as `/flash/add`. This allows attackers to perform Server-Side Request Forgery (SSRF) by queuing arbitrary URLs or cause a Denial of Service (DoS) by exhausting disk space and bandwidth. The issue is fixed in version 0.5.0b3.dev97.

## Affected products

- pyload pyload-ng <= 0.5.0b3.dev96

## Identifiers

- CVE-2026-33314
- GHSA-q485-cg9q-xq2r
- PYSEC-2026-122

## Timeline

- 2026-03-19: advisory: GitHub Advisory published
- 2026-03-19: patched: Fix released in version 0.5.0b3.dev97

## References

- [https://api.github.com/users/Jaynornj](https://api.github.com/users/Jaynornj)
- [https://github.com/Jaynornj](https://github.com/Jaynornj)
- [https://api.github.com/users/Jaynornj/gists%7B/gist_id%7D](https://api.github.com/users/Jaynornj/gists%7B/gist_id%7D)
- [https://api.github.com/users/Jaynornj/repos](https://api.github.com/users/Jaynornj/repos)
- [https://avatars.githubusercontent.com/u/26265990?v=4](https://avatars.githubusercontent.com/u/26265990?v=4)
- [https://api.github.com/users/Jaynornj/events%7B/privacy%7D](https://api.github.com/users/Jaynornj/events%7B/privacy%7D)

## Related threats

- [pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses)
- [pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba)