CVE-2026-50019: yt-dlp Cookie Leak Vulnerability

CVE-2026-50019 Overview

CVE-2026-50019 is an information disclosure vulnerability in yt-dlp, the popular command-line audio and video downloader. The flaw affects versions from 2023.09.24 through 2026.06.09. When yt-dlp uses curl as an external downloader, cookies can leak to unintended hosts during HTTP redirects or when download fragments are served from a different host than the parent manifest. The issue stems from how yt-dlp passes cookies to curl via the --cookie flag without activating the cookie engine, causing curl to send cookies to out-of-scope domains. The vulnerability is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Session cookies and authentication tokens can be transmitted to third-party hosts during redirects, enabling account compromise on services yt-dlp is authenticated against.

Affected Products

yt-dlp versions 2023.09.24 through 2026.06.08
Deployments using curl as the configured external downloader
Workflows that pass cookies inline rather than via cookie file

Discovery Timeline

2026-06-09 - Fixed release 2026.06.09 published by yt-dlp maintainers
2026-06-23 - CVE CVE-2026-50019 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-50019

Vulnerability Analysis

The vulnerability arises in yt-dlp's external downloader integration with curl. When yt-dlp delegates a download to curl, it forwards request cookies using the --cookie command-line option. This option instructs curl to attach the supplied cookies to the initial request but does not enable the full cookie engine. The cookie engine in curl is activated only when cookies are loaded from a file via --cookie <file> referencing a Netscape-format cookie jar, which provides domain and path scoping metadata.

Without the cookie engine active, curl treats the supplied cookies as opaque header values applied to every subsequent request, including those triggered by HTTP redirects. As a result, sensitive session material may be transmitted to hosts the user never intended to authenticate against.

Root Cause

The root cause is missing scope enforcement at the boundary between yt-dlp and curl. yt-dlp passes raw name=value cookie pairs without associated domain and path attributes. curl therefore cannot perform same-origin checks before reattaching the cookies on redirects or fragment fetches that target different hosts.

Attack Vector

An attacker controlling a media host or manifest can craft fragment URLs or HTTP redirects pointing to an attacker-controlled domain. When the victim runs yt-dlp with curl as the external downloader against authenticated content, the attacker's server receives the user's cookies for the original site. Exploitation requires user interaction in the form of running yt-dlp against a malicious or compromised URL.

The vulnerability mechanism is described in detail in the upstream advisory. See the GitHub Security Advisory GHSA-f7j3-774f-rfhj for the underlying code paths and patch diff.

Detection Methods for CVE-2026-50019

Indicators of Compromise

Outbound HTTPS requests from curl processes spawned by yt-dlp to domains outside the originally requested host
yt-dlp invocations using --external-downloader curl combined with --cookies or --add-header Cookie:
Web server logs on authenticated services showing valid session cookies originating from unexpected referrer chains

Detection Strategies

Inventory hosts running yt-dlp and identify installations with versions between 2023.09.24 and 2026.06.08
Audit command-line invocations for the --downloader curl or --external-downloader curl flags combined with cookie arguments
Inspect process telemetry for curl child processes of yt-dlp making cross-domain requests during a single download session

Monitoring Recommendations

Forward process execution and network connection telemetry from systems running yt-dlp into a centralized log platform
Alert on unexpected destination domains contacted within short windows after yt-dlp launches curl
Track yt-dlp version strings across endpoints and flag any host still running a vulnerable release

How to Mitigate CVE-2026-50019

Immediate Actions Required

Upgrade yt-dlp to version 2026.06.09 or later on all systems and CI pipelines
Rotate any session cookies or authentication tokens used with vulnerable yt-dlp invocations against untrusted URLs
Until patched, avoid using curl as the external downloader when cookies are required

Patch Information

The yt-dlp maintainers released version 2026.06.09 to remediate the issue. The fix changes how yt-dlp hands cookies to curl so that scoping is preserved and cookies are not replayed across hosts. Refer to the GitHub Security Advisory GHSA-f7j3-774f-rfhj for upgrade guidance and patch details.

Workarounds

Switch the external downloader to the default native downloader, or to aria2c or ffmpeg, until upgrading
Load cookies from a Netscape-format cookie file via --cookies <file>, which activates curl's cookie engine and enforces scoping
Restrict yt-dlp usage to trusted sources when authenticated cookies are in scope

bash

# Upgrade yt-dlp to the patched release
python3 -m pip install --upgrade "yt-dlp>=2026.06.09"

# Verify version
yt-dlp --version

# Safer invocation: avoid curl external downloader when using cookies
yt-dlp --cookies /path/to/cookies.txt <url>