CVE-2026-111612: falha de alta gravidade em qaiu netdisk-fast-download
netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
qaiu · netdisk-fast-downloadReferências
https://github.com/qaiu/netdisk-fast-downloadhttps://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/common/util/AuthParamCodec.java#L31https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/web/controller/ParserApi.java#L738-L752https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosurehttps://www.vulncheck.com/advisories/netdisk-fast-download-through-0.4.8-credential-disclosure-via-v2-randomauth