CVE-2026-54254
Received Received - Intake

Authorization Header Exposure in Cyberdrop-DL Pixeldrain Crawler

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTED_DOMAINS, and then reuses that input host for API requests. When a Pixeldrain API key is configured, processing a crafted URL from an attacker-controlled lookalike host causes cyberdrop_dl/crawlers/pixeldrain.py to send the Authorization header to that host. The URL may be introduced through a third-party site that can cause downloads for other sites, and the attacker receives the user's Pixeldrain API key. This issue is fixed in version 9.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54254
EUVD
EUVD-2026-78589

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cyberdrop_dl cyberdrop_dl to 9.13.0 (inc)
cyberdrop_dl cyberdrop_dl 9.14.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Cyberdrop-DL (versions 8.5.0 to 9.13.0) involves improper domain validation in the Pixeldrain crawler. Instead of requiring an exact domain match, it uses substring matching, allowing attacker-controlled lookalike domains to receive the user's Pixeldrain API key via the Authorization header during API requests.

Detection Guidance

Check Cyberdrop-DL logs for Pixeldrain API requests to unexpected domains. Review network traffic for outbound Authorization headers to non-standard hosts. Inspect URLs processed by the Pixeldrain crawler for substring matches like 'pixeldrain' in malicious domains.

Impact Analysis

If you used a vulnerable version with a Pixeldrain API key, your key could be leaked to malicious domains. Attackers might then access your Pixeldrain account or resources tied to that API key. The vulnerability requires a crafted URL introduced through a third-party site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing API keys that grant access to user-controlled resources or data.

Mitigation Strategies

Upgrade Cyberdrop-DL to version 9.14.0 or later. Revoke and regenerate any Pixeldrain API keys used with vulnerable versions. Monitor for unauthorized API key usage and block requests to domains containing 'pixeldrain' as a substring.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart