Which versions of Python are affected by CVE-2026-33511?

pyLoad versions 0.4.20 through 0.5.0b3.dev96 contain an authentication bypass in the ClickNLoad feature that allows unauthenticated remote attackers to spoof HTTP Host headers and access restricted…. A patch is available.

How to fix or mitigate CVE-2026-33511?

Within 24 hours: Identify all pyLoad instances in your environment and document current versions. Within 7 days: Upgrade all instances to pyLoad version 0.5.0b3.dev97 or later per vendor advisory. Within 30 days: Audit logs for suspicious Host header manipulation patterns and verify no unauthorized files were written to pyLoad storage directories.

Python CVE-2026-33511

Q: What is the CVSS score of CVE-2026-33511?

CVE-2026-33511 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15001 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-24 GitHub_M

Python Authentication Bypass

8.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.5.0b3.dev97

EUVD ID Assigned

Mar 24, 2026 - 19:30 euvd

EUVD-2026-15001

Analysis Generated

Mar 24, 2026 - 19:30 vuln.today

CVE Published

Mar 24, 2026 - 18:56 nvd

HIGH 8.8

DescriptionGitHub Advisory

pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker through HTTP Host header spoofing. This allows unauthenticated remote users to access localhost-restricted endpoints, enabling them to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code. This issue has been patched in version 0.5.0b3.dev97.

AnalysisAI

pyLoad versions 0.4.20 through 0.5.0b3.dev96 contain an authentication bypass vulnerability in the ClickNLoad feature's local_check decorator that allows remote attackers to spoof the HTTP Host header and access localhost-restricted endpoints without authentication. This vulnerability enables unauthenticated remote users to inject arbitrary downloads, write files to the storage directory, and execute JavaScript code with the privileges of the pyLoad process. The vulnerability has been patched in version 0.5.0b3.dev97, and exploitation appears feasible given the straightforward nature of HTTP header manipulation.

Technical ContextAI

pyLoad is a Python-based download manager that implements a ClickNLoad feature intended to handle download requests from web browsers. The vulnerability resides in the local_check decorator, which is designed to restrict access to certain endpoints by validating that requests originate from localhost (127.0.0.1 or ::1). However, this validation is performed by checking the HTTP Host header rather than the actual source IP address or the X-Forwarded-For chain in a security-conscious manner. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: an attacker can trivially forge the Host header to localhost and bypass the intended local-only access control. The affected product is identified via CPE as cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*, with vulnerable versions spanning from 0.4.20 to 0.5.0b3.dev96. The vulnerability is a classic case of insufficient client-side validation being used as a security boundary instead of proper network-layer or cryptographic controls.

RemediationAI

Immediately upgrade pyLoad to version 0.5.0b3.dev97 or later, which contains the patch that properly validates request origin instead of relying on the Host header. Users unable to upgrade immediately should implement network-level access controls by restricting access to the pyLoad service to trusted IP addresses only (using firewall rules or reverse proxy authentication), disabling the ClickNLoad feature if not required, and ensuring pyLoad runs with minimal privileges (dedicated unprivileged user account). Additionally, deploy pyLoad behind a reverse proxy (such as nginx or Apache) configured with strict Host header validation and request filtering to reject suspicious Host headers. For production deployments, consider running pyLoad in a sandboxed container with restricted filesystem access and network policies. Refer to the official security advisory at https://github.com/pyload/pyload/security/advisories/GHSA-g5j2-gxqh-x7pw for the latest patch information and version recommendations.