Critical python.org Vulnerability Allowed Attackers to Forge Admin-Level API Requests

A critical authentication bypass in python.org's release management API, present since 2014, could have allowed attackers to impersonate administrators and modify release metadata and download/verification URLs, enabling large-scale supply-chain attacks. The flaw was responsibly disclosed on February 23, 2026, patched within 24–48 hours, and post-incident audits found no evidence of exploitation; additional URL/HTTPS validation, test coverage, extended logging, and a Trail of Bits audit were completed.