CVE-2026-111612 in netdisk-fast-download
Summary
by MITRE • 10/16/2026
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in netdisk-fast-download versions through 0.4.8 represents a critical failure in authentication and data protection mechanisms within the ParserApi component. Specifically, the /v2/randomAuth endpoint is exposed to unauthenticated access, allowing any external actor to interact with it without prior verification of identity or privileges. This lack of access control creates an immediate entry point for malicious actors seeking to harvest sensitive user information from the application's backend systems. The core technical flaw lies in the implementation of encryption for authentication tokens and credentials stored within the encryptedAuth blob. Instead of utilizing a dynamic, session-specific key derived from secure random generation or server-side secrets that change per request or user session, the system relies on a static, hard-coded AES key known as nfd_auth_key2026. This design decision fundamentally undermines the confidentiality guarantees provided by symmetric encryption, as the decryption capability is effectively distributed to any party who can inspect the application binary or network traffic.
From an operational perspective, this vulnerability enables severe information disclosure with significant consequences for user privacy and account security. An attacker can repeatedly invoke the /v2/randomAuth endpoint to retrieve encrypted authentication blobs associated with various users. By applying the hard-coded AES key nfd_auth_key2026 locally on their own systems, attackers can decrypt these blobs to reveal plaintext credentials. These recovered data points typically include cloud-drive cookies, session tokens, and potentially passwords. Possession of valid session tokens or cookies allows an attacker to hijack active user sessions without needing the actual password, facilitating unauthorized access to personal files stored in the netdisk service. This capability effectively bypasses multi-factor authentication if it is tied to the same token structure and grants full administrative control over the victim's cloud storage account for the duration of the session validity.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials, as the security mechanism depends on a secret value that is statically embedded in the codebase rather than being managed securely at runtime or configuration time. Furthermore, it maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-359: Exposure of Private Personal Information to an Unauthorized Actor under the broader category of sensitive data exposure. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates Initial Access through Valid Accounts via Session Hijacking or Credential Stuffing if passwords are also exposed. It also supports Discovery and Collection phases by allowing attackers to enumerate valid user sessions and extract personal data for further exploitation or sale on underground markets.
Mitigation strategies must prioritize the immediate removal of hard-coded cryptographic keys from application binaries. The AES key nfd_auth_key2026 should be replaced with a robust key management solution where encryption keys are generated dynamically, stored in secure hardware modules such as HSMs, or managed via environment variables that are not included in source code repositories. Additionally, the /v2/randomAuth endpoint must enforce strict authentication and authorization checks to ensure that only legitimate, authenticated users can request their own authentication tokens. Implementing rate limiting on this endpoint is also advisable to prevent automated scraping attacks even after access controls are strengthened. Developers should conduct a thorough audit of all encryption implementations within the ParserApi module to identify similar patterns where static keys or weak algorithms might be used for protecting other sensitive data fields, ensuring compliance with industry standards like OWASP ASVS regarding secure storage and transmission of authentication credentials.