netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.7NVD modified 2026-10-16 20:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/qaiu/netdisk-fast-download
- https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/common/util/AuthParamCodec.java#L31
- https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/web/controller/ParserApi.java#L738-L752
- https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosure
- https://www.vulncheck.com/advisories/netdisk-fast-download-through-0.4.8-credential-disclosure-via-v2-randomauth
- https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosure