pyLoad's API key validation caches verified keys using only the key identifier, omitting a comparison of the full key hash. An attacker can forge a key that shares the same identifier, causing the cached validation to succeed without re‑checking the key value. This gives the attacker the same permissions as the legitimate key for a 300‑second cache window, constituting a large‐scale authentication bypass (CWE‑287).

All pyLoad installations running versions older than 0.5.0b3.dev101 are vulnerable. The issue affects the pyload:pyload product; no particular operating system or hosting environment is a requirement beyond a running pyLoad service exposed to the network.

The CVSS score of 8.1 marks this as high severity, though the EPSS score is not available, so the exact probability of exploitation is uncertain. Because the flaw is remote, requires only enumeration of small sequential key identifiers, and the vulnerable cache window is short, a bot could rapidly identify and abuse active keys. The vulnerability is not yet in CISA's KEV catalog.