Pyload ng: pyLoad has an authentication bypass in API key validation (check_apikey cache)

The vulnerability exists in pyLoad-ng's API key validation logic where successful API key validations are cached based solely on key_id, which is parsed from user input. On cache hits, the secret part of the API key is not verified, allowing any forged API key with a valid key_id recently used to bypass authentication. The cache stores metadata excluding the key hash, so secret verification is skipped during the cache lifetime (default 300 seconds). Because key_id values are small sequential integers, they are trivial to enumerate, enabling attackers to impersonate users if the cache contains a valid entry for that key_id. The issue affects versions prior to 0.5.0b3.dev101. The CVSS v3.1 score is 8.1 (High), with attack vector network, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can bypass API key secret verification entirely for any key_id whose legitimate key has been used within the last 5 minutes, gaining the same permissions as the legitimate user. This leads to a complete remote authentication bypass, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to trivial key_id enumeration and the ability to forge API keys without knowing secrets during the cache window.

A patch is available for this vulnerability. The vendor should be consulted for the official fix. The core issue is that secret verification must occur on every request, including cache hits. Suggested fixes include storing a hash of the complete API key in the cache and verifying it on each request or keying the cache by a cryptographic hash of the entire API key. Until patched, systems should consider disabling or reducing the cache TTL to minimize exposure, but the definitive remediation is to apply the official patch.