CVE-2026-40594: pyLoad session cookie security downgrade via header spoofing

Executive brief

pyLoad, a download manager, contains a flaw in how it handles secure web connections. An attacker can trick the system into sending login cookies over insecure channels, potentially allowing them to hijack user accounts. Additionally, an attacker can cause a service disruption where users are repeatedly logged out and unable to use the web interface.

Technical details

The vulnerability exists in the `set_session_cookie_secure` handler within `src/pyload/webui/app/__init__.py`. The application reads the `X-Forwarded-Proto` header without validation and uses it to mutate the global Flask configuration `SESSION_COOKIE_SECURE`. In the multi-threaded Cheroot WSGI server environment, this creates a race condition. An unauthenticated remote attacker can spoof this header to either force the `Secure` flag to `False` (enabling session hijacking via cleartext transmission behind a proxy) or force it to `True` on plain HTTP deployments (causing browsers to reject cookies and creating a denial-of-service). The issue is fixed in version 0.5.0b3.dev98.

Affected products

• pyLoad pyload-ng <= 0.5.0b3.dev97

Timeline

• 2026-04-14: disclosed
• 2026-04-16: advisory
• 2026-04-16: patched

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D