CVE-2026-111612 — netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/ra…
Published: 2026-10-16 · CVSS: 8.7 · CVSS 4.0
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7