--- id: "CVE-2026-111612" kind: "vulnerability" aliases: ["CVE-2026-111612"] title: "netdisk-fast-download: unauthenticated endpoint leaks donated cloud-drive credentials" severity: "high" cvss: 8.7 epss: null exploited: false status: "open" category: "package" products: [{"name": "netdisk-fast-download", "fixed": [], "affected": "<= 0.4.8", "ecosystem": "github"}] ecosystems: [] tags: ["credential-disclosure", "hardcoded-key", "java", "netdisk-fast-download", "package", "python", "self-hosted"] not_affected_if: ["endpoint-blocked", "endpoint-not-exposed", "no-donated-accounts", "not-publicly-exposed", "version-above-0.4.8"] published_at: "2026-10-16T18:17:40+00:00" first_seen_at: "2026-10-23T21:57:13+00:00" updated_at: "2026-10-24T00:26:54+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111612", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:26:54+00:00"}] --- # netdisk-fast-download: unauthenticated endpoint leaks donated cloud-drive credentials netdisk-fast-download (qaiu, Java/Vert.x self-hosted direct-link parser) <= 0.4.8 exposes unauthenticated GET /v2/randomAuth?panType=. It returns a random donated account's cloud-drive credential (cookie, token, or username/password) re-encrypted with the public AES key nfd_auth_key2026, which is also the default authEncryptKey in the shipped app-dev.yml and the codec's built-in default. Anyone can decrypt the blob. Rate limiting is off by default. Only instances where users have donated accounts (POST /v2/donateAccount) leak anything. No fixed release exists as of v0.4.8. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - github:netdisk-fast-download affected <= 0.4.8 fixed ? ## How to check This is a Java service, not a pip package: pip show will not find it. Check the release or Docker image you deployed (v0.4.8 or older is affected; latest release is v0.4.8). Test from outside: curl 'http://:6400/v2/randomAuth?panType=qk'. A JSON reply with data.encryptedAuth means you are exposed. Check authEncryptKey in your config (default port 6400). Check whether the donated_account table has rows. ## Fix No fixed version published as of 2026-10-24 (v0.4.8 is the latest and is affected). Mitigate: block /v2/randomAuth at the reverse proxy or firewall, or do not expose the service publicly. Set a unique authEncryptKey (16 chars) in config, though the endpoint still hands out decryptable blobs to anyone who can reach it. If the donation feature was used, treat donated cookies, tokens and passwords as compromised: remove the donated accounts, revoke the sessions and change the passwords at the cloud-drive providers. Enable rateLimit. Watch the repo for a release after 0.4.8. ## Timeline - 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111612 - 2026-10-24T00:26:54+00:00 analyst — Read researcher writeup (hackmd, static source review of v0.4.8, not run live) and VulnCheck record. Project is a Java/Vert.x service (qaiu/netdisk-fast-download, GitHub releases/Docker), not a pip package: tags corrected. Latest release is v0.4.8 (2026-10-13), so no fixed version found; no maintainer advisory seen. No X chatter (7d count 1). CISA SSVC lists PoC and automatable, but the writeup says nothing was executed live; no public PoC link found. ## Documents - [advisory] netdisk-fast-download: unauthenticated /v2/randomAuth leaks donated netdisk credentials (hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosure - [advisory] VulnCheck: netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth https://www.vulncheck.com/advisories/netdisk-fast-download-through-0.4.8-credential-disclosure-via-v2-randomauth - [mentions] qaiu/netdisk-fast-download releases (latest v0.4.8) https://github.com/qaiu/netdisk-fast-download/releases ## From the sources netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_