NetEase Cloud Music: TLS certificate validation bypass
Summary
The Windows desktop client of NetEase Cloud Music (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 does not properly validate TLS server certificates. An attacker on the same network path, such as a shared or hostile Wi-Fi, can intercept HTTPS traffic with a rogue certificate and capture the MUSIC_U session credential. The attacker can also read and modify API responses, which may enable account takeover. No vendor fix is known, and NetEase reportedly did not act on the reports.
Affected
- NetEase Cloud Music for Windows 3.1.38
- NetEase Cloud Music for Windows 3.1.39.205426
Fixed in
Unknown. No fixed version has been published by the vendor.
Workaround
- Uninstall the client on business devices or restrict it to personal, non-corporate devices.
- Do not use the client on untrusted networks.
- Restrict the application's network access and monitor for unusual child processes started by it.
Exploitation
- Not known to be exploited in the wild.
- VulDB reports that no exploit exists. A public technical write-up exists and was not verified by us.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- An unverified aggregator report states that NetEase closed the reports without action.
Our recommendation
- Inventory all Windows endpoints for NetEase Cloud Music and remove it from business and admin devices.
- Do not use the client on public or untrusted networks.
- If the client was used on a hostile network, end the NetEase session and change the account password, especially if the password is reused elsewhere.
- Monitor endpoints for unusual child processes spawned by the application.
- Check for a vendor fix regularly and reinstall only once a fixed version is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: NetEase Cloud Music TLS Certificate Validation Bypass www.vulncheck.com
- Public technical write-up (gist) gist.github.com
- VulDB entry 417212 vuldb.com
- HOL Guard CVE record hol.org
- Rapid7 record via Vulners vulners.com
- OpenCVE record app.opencve.io
- Strix CVE record www.strix.ai
- CraftedSignal brief on sibling CVE-2026-109422 feed.craftedsignal.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:54.
Original description (NVD)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.