CVE-2026-111612

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111612
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111612.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111612
Published
2026-10-16T17:38:51Z
Modified
2026-10-28T02:31:11Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
Details

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-321"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111612.json"
}
References

Affected packages

Git / github.com/qaiu/netdisk-fast-download

Affected ranges

Type
GIT
Repo
https://github.com/qaiu/netdisk-fast-download
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
e9be9b3345ba4b5ef4cc30e499478988f66fe491
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.4.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.4.8"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.1.3-releases
0.1.7-release-fixed3
0.1.8.bate
0.1.8.bate2
0.1.8.fixed1
0.1.8.fixed2
0.1.8.fixed3
0.1.8.proxy
Other
cursor/ghsa-997r-ssrf-verify-2b8b
dependabot/maven/maven-6421fd6730
dependabot/npm_and_yarn/web-front/npm_and_yarn-c42958dede
v019b21a
v0.*
v0.1.8.test
v0.1.9b1
v0.1.9b10
v0.1.9b11
v0.1.9b12
v0.1.9b12b
v0.1.9b13
v0.1.9b16
v0.1.9b17
v0.1.9b19
v0.1.9b2
v0.1.9b20a
v0.1.9b6
v0.1.9b6a
v0.1.9b6b
v0.1.9b6c
v0.1.9b7
v0.1.9b8
v0.1.9b8a
v0.1.9b8b
v0.1.9b9
v0.1.9b9a
v0.1.9b9b
v0.1.9b9c
v0.1.9b9d
v0.1.9b9e
v0.1.9b9f
v0.1.9b9g
v0.1.9b9h
v0.1.9b9i
v0.1.9b9j
v0.1.9b9k
v0.1.9b9l
v0.1.9b9m
v0.1.9b9n
v0.2.1
v0.2.1b3
v0.3.4
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111612.json"