NetEase Youdao LobsterAI encryption vulnerability

NetEase Youdao LobsterAI versions prior to 2026.10.16 had an encryption vulnerability. This vulnerability stemmed from the use of a hardcoded password when exporting API keys. Attackers could obtain the exported files and utilize the salt values embedded within them to derive AES-GCM keys using...

CVE-2026-109424

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109423

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109422

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109424 NetEase Cloud Music Weak Encryption via eapi/xeapi

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109424

The NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 is vulnerable to a weak encryption flaw. The application decrypts /eapi/ and /xeapi/ API response bodies using a fixed, publicly documented AES-128-ECB key without integrity credentials. This allows atta...

EUVD-2026-97819

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109424 NetEase Cloud Music Weak Encryption via eapi/xeapi

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109423

The NetEase Cloud Music client for Windows (cloudmusic.exe ) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability . The software fails to validate the server certificate chain, verify the hostname, or consult the Windows certificate trust store. A network-adjacent...

EUVD-2026-97818

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109422

The NetEase Cloud Music client for Windows (cloudmusic.exe ) versions 3.1.38 and 3.1.39.205426 is vulnerable to Remote Code Execution (RCE) . The flaw exists in the renderer-process IPC bridge os.navigateExternal, which fails to validate the URL scheme before passing caller-supplied URLs to Shell...

EUVD-2026-97817

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

PT-2026-110901

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows cloudmusic.exe version 3.1.38 NetEase Cloud Music client for Windows cloudmusic.exe version 3.1.39.205426 Description The application fails to validate the server certificate chain, verify the hostname, o...

PT-2026-110900

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

PT-2026-110902

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 through 3.1.39.205426 Description The application uses a fixed, publicly documented AES-128-ECB key to decrypt response bodies from the '/eapi/' and '/xeapi/' API endpoints...

CVE-2026-109424: Use of Hard-coded Cryptographic Key

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...