CVE-2026-54254 in Cyberdrop-DL
Summary
by MITRE • 09/15/2026
Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTED_DOMAINS, and then reuses that input host for API requests. When a Pixeldrain API key is configured, processing a crafted URL from an attacker-controlled lookalike host causes cyberdrop_dl/crawlers/pixeldrain.py to send the Authorization header to that host. The URL may be introduced through a third-party site that can cause downloads for other sites, and the attacker receives the user's Pixeldrain API key. This issue is fixed in version 9.14.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Cyberdrop-DL versions ranging from 8.5.0 to 9.14.0 represents a critical authentication credential leakage flaw rooted in improper input validation and host verification logic. As an asynchronous bulk downloader, the application relies on various crawlers to interact with different file hosting services. The specific defect resides in the Pixeldrain crawler implementation, which fails to enforce strict domain matching when processing URLs provided by users or derived from third-party sources. Instead of validating that the target hostname is an exact match against a predefined list of supported domains stored in SUPPORTED_DOMAINS, the code utilizes substring host matching. This lax validation approach allows for the acceptance of lookalike domains that share suffixes with legitimate hosts but are controlled by malicious actors.
The operational impact of this flaw becomes severe when a user has configured their Pixeldrain API key within the application settings. Under normal circumstances, these credentials should only be transmitted to the official Pixeldrain infrastructure to authenticate requests for downloading files. However, due to the substring matching vulnerability, an attacker can craft a URL pointing to a malicious domain that mimics part of the legitimate host structure. When the crawler processes this crafted URL, it incorrectly identifies the request as belonging to a supported service and proceeds to execute the API call. Crucially, because the application is configured with valid credentials for Pixeldrain, it automatically attaches the Authorization header containing the user's sensitive API key to every outgoing HTTP request associated with that host.
This mechanism effectively turns the victim into an unwitting proxy for credential exfiltration. By tricking a user into processing a malicious link, potentially through a compromised third-party site or social engineering vector, the attacker gains access to the Authorization header sent by the application. The API key is transmitted in plaintext over the network to the attacker-controlled server, allowing them to impersonate the victim on Pixeldrain. This compromise grants the attacker full administrative control over the victim's account, including the ability to upload malicious files, delete legitimate content, or access private data stored within their cloud storage space. The severity of this issue is compounded by the fact that it exploits trust in automated tools and relies on user configuration rather than a direct software execution flaw.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to ensure that input data matches expected formats or domains before processing. It also relates closely to CWE-798 Use of Hard-coded Credentials if viewed as improper handling of sensitive authentication material during network communication, though more accurately it falls under CWE-359 Exposure of Private Information in an HTTP Cookie Header or similar transmission contexts where credentials are sent without proper destination verification. In the context of the MITRE ATT&CK framework, this behavior is indicative of T1078 Valid Accounts, as the attacker leverages stolen valid credentials to gain unauthorized access, and potentially T1566 Phishing if the initial vector involves tricking users into clicking malicious links that trigger the download tool.
The recommended mitigation for organizations and individuals using Cyberdrop-DL is to immediately upgrade to version 9.14.0 or later, where this logic has been corrected to enforce exact domain matching against the supported list before initiating any API requests. For environments unable to update immediately due to dependency constraints, manual verification of crawler source code to ensure strict equality checks are performed on hostnames can provide temporary relief. Additionally, users should rotate their Pixeldrain API keys if they suspect exposure through older versions and consider implementing network-level monitoring or egress filtering to detect anomalous outbound requests containing authentication headers to unexpected destinations. Regular auditing of third-party tool configurations and input validation practices remains essential for maintaining security posture in automated download workflows.