CVE-2026-111612 Details

A vulnerability allowing information disclosure has been identified in netdisk-fast-download versions through 0.4.8. This issue allows unauthenticated attackers to access donated netdisk credentials by exploiting the /v2/randomAuth endpoint within the ParserApi. The vulnerability arises because the endpoint decrypts stored credentials, which are meant to be secret, using a hard-coded AES key, and returns them in a reversible encrypted form. Attackers can repeatedly call this endpoint to retrieve and decrypt the credentials of other users, including cloud-drive cookies, tokens, or passwords.

The vulnerability can be addressed by removing the /v2/randomAuth endpoint or restricting it to internal server calls, ensuring that donated credentials are not returned to the client. Additionally, the hard-coded encryption key should be removed, and the default key in the shipped configuration should be replaced with a unique, randomly generated key.