CVE-2026-109424: NetEase Cloud Music Weak Encryption via eapi/xeapi
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the Windows NetEase Cloud Music client running versions 3.1.38 or 3.1.39.205426 are affected when the client processes responses from the /eapi/ or /xeapi/ endpoints.
What does an attacker need to exploit it?
An attacker must be able to intercept API responses or originate responses that the client accepts. No client-side privileges or user interaction are required, but the attack complexity is rated high.
Why can forged responses be accepted?
The client decrypts response bodies with a fixed, publicly documented AES-128-ECB key and does not use an integrity credential. An attacker can create ciphertext using that known key and valid PKCS#7 padding, allowing forged API response content to be accepted.
What is the direct security impact?
The vulnerability enables modification of API response content accepted by the client, with integrity impact rated high. It is described as a prerequisite for additional exploitation paths, including reaching the os.navigateExternal bridge.