Live › vulnerability › CVE-2026-111612
Go to dashboardnetdisk-fast-download (qaiu, Java/Vert.x self-hosted direct-link parser) <= 0.4.8 exposes unauthenticated GET /v2/randomAuth?panType=<code>. It returns a random donated account's cloud-drive credential (cookie, token, or username/password) re-encrypted with the public AES key nfd_auth_key2026, which is also the default authEncryptKey in the shipped app-dev.yml and the codec's built-in default. Anyone can decrypt the blob. Rate limiting is off by default. Only instances where users have donated accounts (POST /v2/donateAccount) leak anything. No fixed release exists as of v0.4.8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| netdisk-fast-download | github | <= 0.4.8 | – |
pip show will not find itv0.4.8 or older is affected; latest release is v0.4.8)http://<host>:6400/v2/randomAuth?panType=qkv0.4.8 is the latest and is affected)0.4.8Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
This page as .md · .json · in your agent: get_signal("CVE-2026-111612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.