netdisk-fast-download: Information disclosure in /v2/randomAuth endpoint
Summary
netdisk-fast-download through version 0.4.8 discloses donated cloud-drive credentials. The unauthenticated /v2/randomAuth endpoint returns encrypted credential blobs that can be decrypted with a hard-coded AES key, which is publicly documented in the project. An attacker can call the endpoint repeatedly and recover other users' cookies, tokens or passwords for cloud-drive accounts, which exposes those accounts to unauthorised access.
Affected
- netdisk-fast-download versions 0 to and including 0.4.8
- Default configuration, in which authEncryptKey is not set to a custom value
Fixed in
Unknown. No fixed version has been confirmed.
Workaround
- Do not send cloud-drive credentials to public instances of the service.
- Set a custom authEncryptKey on self-hosted instances. Whether this stops the /v2/randomAuth disclosure is unverified.
- Restrict or block /v2/randomAuth at a reverse proxy. This is unverified and may break functionality.
Exploitation
- CISA SSVC assessment: exploitation status 'poc', automatable: yes, technical impact: partial.
- A public write-up exists (HackMD). Whether it includes runnable exploit code is unconfirmed.
- No evidence of active exploitation in the wild was found.
Our recommendation
- Treat any cloud-drive credential ever submitted to this service as compromised and rotate it.
- Check whether netdisk-fast-download is used in your environment, including self-hosted instances, and identify exposed instances.
- Update to a fixed version once one is released, or restrict access to the service.
- Review logs for unusually high request volumes to /v2/randomAuth.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- netdisk-fast-download GitHub repository github.com
- AuthParamCodec.java at v0.4.8 github.com
- ParserApi.java at v0.4.8 github.com
- VulnCheck advisory www.vulncheck.com
- HackMD write-up on randomAuth credential disclosure hackmd.io
- GitHub issue #276: hardcoded default AES key github.com
- VulDB entry 421367 vuldb.com
- Vulners MEND:CVE-2026-111612 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:15.
Original description (NVD)
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.
NVD references (6)
- https://github.com/qaiu/netdisk-fast-download
- https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/common/util/Au…
- https://github.com/qaiu/netdisk-fast-download/blob/v0.4.8/web-service/src/main/java/cn/qaiu/lz/web/controller…
- https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosure
- https://www.vulncheck.com/advisories/netdisk-fast-download-through-0.4.8-credential-disclosure-via-v2-randoma…
- https://hackmd.io/@hieuPenguinnn/netdisk-fast-download-randomauth-donated-credential-disclosure
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.