CVE-2026-109423 Details
Description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
A vulnerability in the NetEase Cloud Music client for Windows, specifically in versions 3.1.38 and 3.1.39.205426, has been identified. This vulnerability arises from improper validation of TLS certificates, allowing network-adjacent attackers to intercept and decrypt HTTPS traffic. The client fails to validate the server certificate chain, verify hostnames, or consult the Windows certificate trust store. Exploitation of this vulnerability enables attackers to perform man-in-the-middle attacks, using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential from authenticated API requests, and modify server responses in transit. This could lead to account takeover and transport-layer response forgery.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9f | [email protected] | BundleTechnical Analysis |
| https://hr.163.com/product.html/music | [email protected] | Broken LinkVendor |
| https://www.vulncheck.com/advisories/netease-cloud-music-tls-certificate-validation-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetEase Cloud Music | <= 3.1.38 (semver) <= 3.1.39.205426 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |