CVE-2026-109424 Details
Description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.
A vulnerability exists in the NetEase Cloud Music client for Windows, specifically in versions 3.1.38 and 3.1.39.205426. This vulnerability involves weak encryption, as the API response bodies for the '/eapi/' and '/xeapi/' endpoints are decrypted using a fixed AES-128-ECB key. This key is publicly known and documented, and the encryption lacks any integrity verification. As a result, attackers who can intercept or send server responses may forge valid ciphertext that the client will accept, potentially leading to further exploitation, such as accessing the 'os.navigateExternal' bridge.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9f | [email protected] | BundleTechnical Analysis |
| https://hr.163.com/product.html/music | [email protected] | Broken LinkVendor |
| https://www.vulncheck.com/advisories/netease-cloud-music-weak-encryption-via-eapi-xeapi | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetEase Cloud Music | 3.1.38 (semver) 3.1.39.205426 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |