CVE-2026-33314: pyload-ng Host Header Spoofing Vulnerability Leading to SSRF and DoS
Summary
CVE-2026-33314: Improper Authentication and Origin Validation Error in pyload-ng. Affects pyload-ng versions < 0.5.0b3.dev97. Fixed in 0.5.0b3.dev97. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyload-ng is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It features a web interface and supports plugins for extended functionality, including the Click'N'Load plugin, which is designed for local use. However, due to a flaw in its authentication mechanism, it is vulnerable to exploitation by external attackers.
Vulnerability Detail
The vulnerability arises from an improper authentication and origin validation error in the @local_check decorator used in the pyload-ng application. This flaw allows unauthenticated external attackers to spoof the HTTP Host header, bypassing local-only restrictions and gaining unauthorized access to the Click'N'Load API endpoints. As a result, attackers can queue arbitrary downloads, leading to potential Server-Side Request Forgery (SSRF) and Denial of Service (DoS) attacks. The affected routes include /flash/ and /flash/add, among others.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0b3.dev97
This is the first release that contains the fix.
pip install --upgrade "pyload-ng==0.5.0b3.dev97"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the pyload-ng service by configuring your firewall to allow connections only from trusted IP addresses. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2026-33314 vulnerability in pyload-ng poses significant risks due to improper authentication and origin validation. It is crucial for users to update to the patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-33314 is a vulnerability in the pyload-ng package that allows unauthenticated attackers to bypass local-only restrictions and access protected API endpoints.
The vulnerability can lead to unauthorized access to the Click'N'Load API, allowing attackers to queue malicious downloads and potentially cause SSRF and DoS attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider implementing firewall rules to restrict access to the pyload-ng service to trusted IP addresses as a temporary measure.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
