{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pyload-ng--0.5.0b3.dev101/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pyload-ng (\u003e= 0.5.0b3.dev1, \u003c= 0.5.0b3.dev101)","pyLoad-ng (\u003c= 0.5.0b3.dev101)"],"_cs_severities":["high"],"_cs_tags":["credential-access","authentication-bypass","web-application"],"_cs_type":"advisory","_cs_vendors":["pyLoad"],"content_html":"\u003cp\u003eResearch has identified a critical vulnerability in pyload-ng (versions 0.5.0b3.dev1 through 0.5.0b3.dev101) originating from an incorrectly implemented permission gate. The \u003ccode\u003eApi.getUserData\u003c/code\u003e and \u003ccode\u003eApi.get_userdata\u003c/code\u003e endpoints are decorated with \u003ccode\u003e@permission(Perms.ANY)\u003c/code\u003e. In the pyload-ng codebase, \u003ccode\u003ePerms.ANY\u003c/code\u003e is defined as \u003ccode\u003e0\u003c/code\u003e, and the permission validation logic uses a bitmask AND operation. Consequently, any authenticated session, regardless of privileges, satisfies the \u003ccode\u003ehas_permission\u003c/code\u003e check. These endpoints act as thin wrappers around the internal \u003ccode\u003echeck_auth\u003c/code\u003e method, which is intended to be restricted to administrators. By passing an arbitrary password to these endpoints, an attacker can determine if the password is valid based on the API response, creating a high-speed brute-force oracle. This vulnerability is significantly amplified by the lack of account lockout mechanisms and a flaw in the rate-limiting implementation that permits bypassing by rotating the \u003ccode\u003eX-Forwarded-For\u003c/code\u003e HTTP header.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to a low-privileged account on a pyload-ng instance (e.g., \u003ccode\u003erole=USER\u003c/code\u003e, \u003ccode\u003epermission=0\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker initiates an authenticated session using their own credentials.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the target administrative account (e.g., 'pyload').\u003c/li\u003e\n\u003cli\u003eAttacker constructs a script to iterate through password guesses using the \u003ccode\u003e/api/getUserData\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eFor each attempt, the attacker modifies the \u003ccode\u003eX-Forwarded-For\u003c/code\u003e header to bypass the 100 req/min rate limit bucket.\u003c/li\u003e\n\u003cli\u003eAttacker monitors the HTTP response: a \u003ccode\u003e200 OK\u003c/code\u003e with null data indicates an incorrect password, while a \u003ccode\u003e200 OK\u003c/code\u003e with user details confirms successful authentication.\u003c/li\u003e\n\u003cli\u003eUpon identifying the correct password, the attacker authenticates as the administrator via the \u003ccode\u003e/login\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker uses administrative privileges to exfiltrate all user data or perform other unauthorized actions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover of the pyload-ng instance. An attacker can recover the administrator's password via automated brute force, as there are no failed-login throttles or account lockout policies. Once the admin account is compromised, the attacker gains complete control over the application, including the ability to dump sensitive user data and credentials stored in the system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of pyload-ng as soon as a fix is available, or remove the vulnerable \u003ccode\u003egetUserData\u003c/code\u003e and \u003ccode\u003eget_userdata\u003c/code\u003e methods if they are not required.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for web traffic to ensure that the \u003ccode\u003eX-Forwarded-For\u003c/code\u003e header is only trusted when originating from a validated, internal proxy.\u003c/li\u003e\n\u003cli\u003eConfigure the web server to use the real client IP address for rate-limiting calculations instead of trusting client-supplied headers.\u003c/li\u003e\n\u003cli\u003eApply granular rate limiting or account lockout policies to mitigate automated brute-force attempts.\u003c/li\u003e\n\u003cli\u003eEnable account-level monitoring for unusual spikes in failed authentication attempts directed at administrative accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-09T21:27:44Z","date_published":"2026-10-09T21:25:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pyload-auth-bypass/","summary":"An insecure permission check in the pyload-ng API allows any authenticated user to perform administrative password brute-forcing via a side-channel oracle.","title":"Authentication Bypass and Brute-Force Oracle in pyload-ng","url":"https://feed.craftedsignal.io/briefs/2026-10-pyload-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - PyLoad-Ng (\u003c= 0.5.0b3.dev101)","version":"https://jsonfeed.org/version/1.1"}