pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
- Exploited
- No known exploitation
- Fix
- Fixed in 0.5.0b3.dev102
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 0.5.0b3.dev102.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 19/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
pyLoad, a Python download manager, is affected through its WindowsPhoneNotify addon. An attacker with a low-privileged account that has the SETTINGS permission can remotely make the server send blind HTTP requests to internal hosts they choose, which can probe internal services or trigger state-changing internal endpoints, with limited confidentiality and integrity impact.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure3/25Reachable over the network · Unknown: No advisory context yet
- Reach10/20Affects PyPI packages
- Severity6.4/10CVSS 6.4
- No patch0/5No signal
What would change the score
- Would score about 74 if added to CISA KEV
- Would score about 69 if CISA's SSVC rates exploitation active
- Would score about 38 if advisories confirm default setups are exposed
Impact
- Widely used
pyload-ng has 1.2k weekly downloads.Source: pypistats.org
1 packages depend on pyload-ng.Source: deps.dev
What to do
Upgrade to a fixed version: 0.5.0b3.dev102.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- pyload pyload
fixed in 0.5.0b3.dev102
- pyload-ngPyPI
through 0.5.0b3.dev101
No fix released.
Evidence 2
- Advisory
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123814
Is CVE-2026-123814 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-123814?
pyload: before 0.5.0b3.dev102. pyload-ng (PyPI): through 0.5.0b3.dev101.Source: cve.now feed data
How do I fix CVE-2026-123814?
Upgrade to a fixed version: 0.5.0b3.dev102.Source: cve.now feed data