CVE-2026-111612: netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfdauthkey2026 to recover other users' cloud-drive cookies, tokens, or passwords.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize netdisk-fast-download deployments through version 0.4.8, especially instances that store donated netdisk credentials and expose the ParserApi service over the network.
Does an attacker need an account or user interaction to exploit this issue?
No. The issue can be exploited without authentication or user interaction by repeatedly calling the /v2/randomAuth endpoint.
What information could be exposed if the endpoint is exploited?
Attackers can recover donated cloud-drive credentials from the encryptedAuth data, including cookies, tokens, or passwords. The encrypted data can be decrypted using the hard-coded AES key nfd_auth_key2026.