CVE-2024-22416

pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

• CWE-352
• CWE-352

• https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3ePatch
• https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fcPatch
• https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fmExploit, Third Party Advisory
• https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3ePatch
• https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fcPatch
• https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fmExploit, Third Party Advisory

Published

Jan 18, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22410Creditcoin is a network that enables cross-blockchain credit…7.8
• CVE-2024-22411Avo is a framework to create admin panels for Ruby on Rails …5.4
• CVE-2024-22412ClickHouse is an open-source column-oriented database manage…4.9
• CVE-2024-22413Rejected reason: Further research determined the issue is no…
• CVE-2024-22414flaskBlog is a simple blog app built with Flask. Improper st…5.4
• CVE-2024-22415jupyter-lsp is a coding assistance tool for JupyterLab (code…9.8
• CVE-2024-22417Whoogle Search is a self-hosted metasearch engine. In versio…6.1
• CVE-2024-22418Group-Office is an enterprise CRM and groupware tool. Affect…5.4
• CVE-2024-22419Vyper is a Pythonic Smart Contract Language for the Ethereum…9.8
• CVE-2024-2242The Contact Form 7 plugin for WordPress is vulnerable to Ref…6.1
• CVE-2024-22420JupyterLab is an extensible environment for interactive and …6.1
• CVE-2024-22421JupyterLab is an extensible environment for interactive and …6.5