CVE-2026-42312
Authentication Bypass via SSL Verification Disable in pyLoad
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pyload | pyload | to 0.5.0b3.dev100 (exc) |
| pyload | pyload-ng | to 0.5.0b3.dev99 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to intercept and manipulate data by disabling TLS certificate validation, which can lead to exposure of sensitive information.
Such exposure and potential data manipulation can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require protection of data confidentiality and integrity during transmission.
By enabling man-in-the-middle attacks, the vulnerability undermines the security controls necessary to meet these regulatory requirements.
Can you explain this vulnerability to me?
CVE-2026-42312 is a vulnerability in pyload-ng versions up to 0.5.0b3.dev99 that allows non-admin users with the SETTINGS permission to disable outbound TLS peer verification by setting the ssl_verify configuration option to "off."
This happens because the ssl_verify option was not included in the ADMIN_ONLY_CORE_OPTIONS allowlist, which is supposed to restrict security-sensitive settings to admin users only.
As a result, an attacker on the network path can intercept and forge certificates for any HTTPS endpoint accessed by pyload, enabling data interception or manipulation.
How can this vulnerability impact me? :
This vulnerability can lead to a man-in-the-middle attack where an attacker intercepts and manipulates data transmitted by pyload.
- Sensitive data such as downloads, captcha fetches, and update checks can be exposed or altered.
- TLS peer and hostname verification are disabled, removing protections against forged certificates.
The severity is rated as Moderate with a CVSS score of 6.8, due to the low privilege required to exploit it and the high impact on confidentiality and integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if any non-admin user with SETTINGS permission has set the configuration option general.ssl_verify to off in pyload.
You can inspect the pyload configuration files or query the pyload API to verify the value of ssl_verify.
Additionally, monitoring outbound pycurl requests for disabled SSL verification flags (SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0) can help detect exploitation.
- Check pyload configuration for ssl_verify setting: grep -r 'ssl_verify' /path/to/pyload/config
- Use pyload API or command line to query current settings if available.
- Monitor network traffic for suspicious TLS connections that do not perform proper certificate verification.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to upgrade pyload to version 0.5.0b3.dev100 or later, where this vulnerability is fixed.
Until the upgrade can be performed, restrict non-admin users from having the SETTINGS permission to prevent them from disabling ssl_verify.
Review and enforce the allowlist ADMIN_ONLY_CORE_OPTIONS to ensure that security-sensitive options like ssl_verify cannot be modified by unauthorized users.
Monitor and audit configuration changes related to ssl_verify to detect any unauthorized modifications.