Critical Authentication Bypass Flaw in Python.org API Patched After Decade-Long Exposure A severe authentication bypass vulnerability in Python.org’s release management API, present since 2014, was disclosed and patched in February 2026. The flaw, reported by Splitline Ng of the DEVCORE Research Team on February 23, could have allowed attackers to impersonate administrators by supplying an admin username with an arbitrary API key, granting full administrative privileges. If exploited, the vulnerability would have enabled threat actors to alter Python release metadata, including download URLs and verification materials (Sigstore signatures and PGP keys) on python.org/downloads. While attackers could not directly modify release binaries, tampering with verification links could have facilitated large-scale supply chain attacks targeting Python users and downstream distributors globally. The Python Security Response Team (PSRT) confirmed the flaw on a local instance and deployed a patch (python/pythondotorg#2946) within 48 hours, with DEVCORE verifying the fix by February 24. Post-incident forensics, including log audits and artifact signature verification across Python versions 2.5 to 3.13, found no evidence of exploitation. Additional security measures were implemented to mitigate future risks: - URL validation: Restricted to `https://www.python.org/` to prevent malicious redirects. - HTTPS enforcement: Trail of Bits’ audit introduced a custom validator for HTTPS-only URLs in newer releases. - Negative auth test cases: Expanded test coverage for authentication failures. - Extended log retention: Increased from 3 to 30 days for improved auditing. A third-party audit by Trail of Bits, funded by OpenAI and completed on June 1, confirmed no further authentication or authorization issues. Earlier LLM-assisted audits in April also returned no additional vulnerabilities.