The Python Software Foundation disclosed and mitigated an API authentication bypass vulnerability in the python.org release management API, reported by Splitline Ng from DEVCORE Research Team on February 23rd, 2026. The flaw, present in the codebase since 2014, allowed an attacker to supply an admin username with an arbitrary API key to gain admin privileges, potentially enabling modification of Python release download URLs and verification material links. No evidence of exploitation was found after auditing logs, database backups, and verifying Sigstore and PGP signatures for all artifacts. The patch was deployed within 48 hours. Additional hardening measures included rejecting non-HTTPS python.org URLs at the database and API level, adding negative authentication test cases, and increasing log retention from 3 to 30 days. A third-party audit by Trail of Bits (funded by OpenAI) was completed before this report's publication, with full results forthcoming.
