The flaw allows an attacker to send a forged X-Forwarded-Proto header that is unvalidated and causes the application to flip the global SESSION_COOKIE_SECURE flag (CWE-346). The race condition in the multithreaded Cheroot server means that one request can change the secure flag for other users' sessions. The likely impact is that secure cookies become transmitted over an insecure connection, giving the attacker the opportunity to hijack those sessions or, in a plain HTTP deployment, to force a denial of service by preventing users from establishing secure sessions.

The vulnerable software is the pyLoad download manager, versions earlier than 0.5.0b3.dev98. The issue is present in the pyload:pyload product, where the Flask configuration is altered during request handling.

The CVSS score of 4.8 indicates moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog, so it is not a known exploited vulnerability. Exploitation requires the attacker to be able to send a request that includes an X-Forwarded-Proto header or to manipulate traffic through a proxy that the application trusts. The likely attack vector is a network‑based attack that relies on the application accepting an unvalidated header. Although no public exploits are reported at this time, the race condition could allow a malicious actor to downgrade session cookie security or disrupt service, especially on systems lacking TLS.