CVE-2026-109423: NetEase Cloud Music TLS Certificate Validation Bypass
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSICU session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
NetEase Cloud Music for Windows is affected in versions 3.1.38 and 3.1.39.205426. The vulnerable component is cloudmusic.exe.
What must an attacker be able to do to exploit it?
An attacker must be network-adjacent and able to position themselves to intercept the client's HTTPS traffic. No authentication or user interaction is required.
What security impact can successful interception have?
An attacker can decrypt HTTPS traffic, capture the MUSIC_U session credential from authenticated API requests, and alter responses while they are in transit. Captured session credentials can enable account takeover.
Why can a rogue certificate be used for the interception?
The client fails to validate the server certificate chain, verify the hostname, or consult a Windows certificate trust store. This allows a man-in-the-middle attacker to use a rogue certificate authority.