https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:05:18 +0000 https://cve.radiocsirt.org/vuln/cve-2026-40594 <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the global Flask configuration SESSION_COOKIE_SECURE on every request. Because pyLoad uses the multi-threaded Cheroot WSGI server (request_queue_size=512), this creates a race condition where an attacker&#39;s request can influence the Secure flag on other users&#39; session cookies — either downgrading cookie security behind a TLS proxy or causing a session denial-of-service on plain HTTP deployments. This vulnerability is fixed in 0.5.0b3.dev98.</p> <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the global Flask configuration SESSION_COOKIE_SECURE on every request. Because pyLoad uses the multi-threaded Cheroot WSGI server (request_queue_size=512), this creates a race condition where an attacker&#39;s request can influence the Secure flag on other users&#39; session cookies — either downgrading cookie security behind a TLS proxy or causing a session denial-of-service on plain HTTP deployments. This vulnerability is fixed in 0.5.0b3.dev98.</p> https://cve.radiocsirt.org/vuln/cve-2026-40594 https://cve.radiocsirt.org/vuln/ghsa-mp82-fmj6-f22v <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Summary</p> <p>The `set_session_cookie_secure` `before_request` handler in `src/pyload/webui/app/__init__.py` reads the `X-Forwarded-Proto` header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the **global** Flask configuration `SESSION_COOKIE_SECURE` on every request. Because pyLoad uses the multi-threaded Cheroot WSGI server (`request_queue_size=512`), this creates a race condition where an attacker&#39;s request can influence the `Secure` flag on other users&#39; session cookies — either downgrading cookie security behind a TLS proxy or causing a session denial-of-service on plain HTTP deployments.</p> <p>## Details</p> <p>The vulnerable code is in `src/pyload/webui/app/__init__.py:75-84`:</p> <p>```python # Dynamically set SESSION_COOKIE_SECURE according to the value of X-Forwarded-Proto # TODO: Add trusted proxy check @app.before_request def set_session_cookie_secure(): x_forwarded_proto = flask.request.headers.get(&#34;X-Forwarded-Proto&#34;, &#34;&#34;) is_secure = ( x_forwarded_proto.split(&#39;,&#39;)[0].strip() == &#34;https&#34; or app.config[&#34;PYLOAD_API&#34;].get_config_value(&#34;webui&#34;, &#34;use_ssl&#34;) ) flask.current_app.config[&#39;SESSION_COOKIE_SECURE&#39;] = is_secure ```</p> <p>The root cause has two components:</p> <p>1. **No origin validation (CWE-346):** The `X-Forwarded-Proto` header is read from any client request. This header is only trustworthy when set by a known reverse proxy. Without `ProxyFix` middleware or a trusted proxy allowlist, any client can…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>## Summary</p> <p>The `set_session_cookie_secure` `before_request` handler in `src/pyload/webui/app/__init__.py` reads the `X-Forwarded-Proto` header from any HTTP request without validating that the request originates from a trusted proxy, then mutates the **global** Flask configuration `SESSION_COOKIE_SECURE` on every request. Because pyLoad uses the multi-threaded Cheroot WSGI server (`request_queue_size=512`), this creates a race condition where an attacker&#39;s request can influence the `Secure` flag on other users&#39; session cookies — either downgrading cookie security behind a TLS proxy or causing a session denial-of-service on plain HTTP deployments.</p> <p>## Details</p> <p>The vulnerable code is in `src/pyload/webui/app/__init__.py:75-84`:</p> <p>```python # Dynamically set SESSION_COOKIE_SECURE according to the value of X-Forwarded-Proto # TODO: Add trusted proxy check @app.before_request def set_session_cookie_secure(): x_forwarded_proto = flask.request.headers.get(&#34;X-Forwarded-Proto&#34;, &#34;&#34;) is_secure = ( x_forwarded_proto.split(&#39;,&#39;)[0].strip() == &#34;https&#34; or app.config[&#34;PYLOAD_API&#34;].get_config_value(&#34;webui&#34;, &#34;use_ssl&#34;) ) flask.current_app.config[&#39;SESSION_COOKIE_SECURE&#39;] = is_secure ```</p> <p>The root cause has two components:</p> <p>1. **No origin validation (CWE-346):** The `X-Forwarded-Proto` header is read from any client request. This header is only trustworthy when set by a known reverse proxy. Without `ProxyFix` middleware or a trusted proxy allowlist, any client can…</p> https://cve.radiocsirt.org/vuln/ghsa-mp82-fmj6-f22v