---
id: CVE-2023-0055
aliases:
  - GHSA-m3g7-wrrq-v5c8
  - PYSEC-2026-905
title: Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
summary: Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: pyload-ng
product: pyload-ng
ecosystem: pip
affected:
  - pyload-ng < 0.5.0b3.dev32
patched:
  - pyload-ng 0.5.0b3.dev32
published: '2023-01-05'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m3g7-wrrq-v5c8'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-0055'
  - url: >-
      https://github.com/pyload/pyload/commit/7b53b8d43c2c072b457dcd19c8a09bcfc3721703
  - url: 'https://github.com/pyload/pyload'
  - url: 'https://huntr.dev/bounties/ed88e240-99ff-48a1-bf32-8e1ef5f13cce'
tags:
  - osv
  - pip
epss: 0.00439
epssPercentile: 0.37651
ingestedAt: '2026-07-08T18:25:51.079Z'
---

## Overview

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. This issue is patched in version 0.5.0b3.dev32.

## Affected packages

- `pyload-ng < 0.5.0b3.dev32`

## Remediation

Upgrade to a patched release:

- `pyload-ng 0.5.0b3.dev32`