CVE-2026-40594: pyLoad Race Condition Vulnerability

CVE-2026-40594 Overview

CVE-2026-40594 is a race condition vulnerability in pyLoad, a free and open-source download manager written in Python. The vulnerability exists in the set_session_cookie_secure before_request handler within src/pyload/webui/app/__init__.py. This handler reads the X-Forwarded-Proto header from HTTP requests without validating that requests originate from a trusted proxy, then mutates the global Flask configuration SESSION_COOKIE_SECURE on every request. Because pyLoad uses the multi-threaded Cheroot WSGI server with request_queue_size=512, this creates a race condition where an attacker's request can influence the Secure flag on other users' session cookies.

Critical Impact

Attackers can downgrade session cookie security for users behind TLS proxies or cause session denial-of-service on plain HTTP deployments by manipulating the X-Forwarded-Proto header in a multi-threaded environment.

Affected Products

• pyLoad versions prior to 0.5.0b3.dev98
• pyLoad web UI deployments using the Cheroot WSGI server
• pyLoad instances behind reverse proxies or load balancers

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40594 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40594

Vulnerability Analysis

This vulnerability stems from improper origin validation (CWE-346) in pyLoad's session cookie handling mechanism. The set_session_cookie_secure function processes the X-Forwarded-Proto header on every incoming HTTP request without verifying whether the request genuinely originates from a trusted reverse proxy or load balancer.

The fundamental issue is that the handler modifies global Flask configuration state (SESSION_COOKIE_SECURE) based on untrusted client input. In a multi-threaded environment like the Cheroot WSGI server, this creates a Time-of-Check Time-of-Use (TOCTOU) race condition where concurrent requests can interfere with each other's session cookie security settings.

An attacker can exploit this by sending crafted requests with a manipulated X-Forwarded-Proto header set to either http or https. Due to the race condition, this can affect session cookies being set for other legitimate users, potentially:

1. Downgrading cookie security: Removing the Secure flag from cookies intended for HTTPS connections, making them vulnerable to interception over unencrypted channels
2. Session denial-of-service: On plain HTTP deployments, toggling the Secure flag can prevent cookies from being sent, effectively breaking session management

Root Cause

The root cause is the combination of two design flaws: trusting the X-Forwarded-Proto header without origin validation, and modifying global configuration state on a per-request basis in a multi-threaded server environment. The request_queue_size=512 setting in Cheroot allows for significant concurrent request processing, amplifying the exploitability of this race condition.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends HTTP requests with a spoofed X-Forwarded-Proto header to the pyLoad web UI. Due to the race condition in the multi-threaded server, these malicious requests can influence the SESSION_COOKIE_SECURE setting applied to other users' session cookies being generated concurrently.

The attack mechanism involves exploiting the timing window between when the header is read and when session cookies are set for other users. High request volume increases the probability of successful exploitation.

Detection Methods for CVE-2026-40594

Indicators of Compromise

• Unusual patterns of X-Forwarded-Proto header values in web server access logs
• Inconsistent session cookie attributes observed in browser developer tools or network captures
• User reports of unexpected session terminations or authentication failures
• High volume of requests from single sources with varying X-Forwarded-Proto values

Detection Strategies

• Monitor HTTP access logs for requests containing X-Forwarded-Proto headers from non-proxy IP addresses
• Implement log correlation to identify timing patterns consistent with race condition exploitation attempts
• Deploy web application firewall (WAF) rules to flag or block requests with suspicious proxy headers from untrusted sources

Monitoring Recommendations

• Enable detailed logging for the pyLoad web UI including all HTTP headers
• Set up alerts for anomalous session cookie behavior or unexpected authentication failures
• Monitor for high-frequency requests to the pyLoad web interface that may indicate exploitation attempts

How to Mitigate CVE-2026-40594

Immediate Actions Required

• Upgrade pyLoad to version 0.5.0b3.dev98 or later immediately
• If immediate upgrade is not possible, restrict access to the pyLoad web UI to trusted networks only
• Configure upstream reverse proxies to strip or normalize X-Forwarded-Proto headers from client requests
• Review firewall rules to ensure only legitimate proxy servers can forward requests to pyLoad

Patch Information

The vulnerability is fixed in pyLoad version 0.5.0b3.dev98. The fix addresses the improper origin validation by ensuring the X-Forwarded-Proto header is only trusted from validated proxy sources and prevents race conditions in session cookie configuration. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Deploy pyLoad behind a reverse proxy that strips incoming X-Forwarded-Proto headers and sets them based on actual connection security
• Restrict network access to the pyLoad web interface using firewall rules or VPN
• Consider running pyLoad in a single-threaded configuration temporarily, though this may impact performance

# Example nginx configuration to normalize X-Forwarded-Proto
# Add to your nginx server block proxying to pyLoad
proxy_set_header X-Forwarded-Proto $scheme;