CVE-2026-111612
netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
qaiu netdisk-fast-download
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
Text from CVE List
Affected versions 1
- netdisk-fast-downloadaffected: all versions through 0.4.8CVE List
References 5
- vulncheck.com/advisories/netdisk-fast-download-through-0.4.8-credential-disclosure-via-v2-randomauthAdvisoryvia CVE List
- hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosureExploitvia CVE List
- github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/web/controller/ParserApi.java#L738-L752Referencevia CVE List
- github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/common/util/AuthParamCodec.java#L31Referencevia CVE List
- github.com/qaiu/netdisk-fast-downloadReferencevia CVE List