Key points
- CVE-2026-111612 affects netdisk-fast-download versions up to 0.4.8.
- The vulnerability has a CVSS score of 8.7, rated as high severity.
- Attackers can decrypt user authentication data using a static AES key.
An information disclosure vulnerability in netdisk-fast-download exposes user credentials to unauthenticated attackers. The flaw, tracked as CVE-2026-111612, allows remote exploitation of systems running version 0.4.8 or earlier.
What happened
The National Vulnerability Database records CVE-2026-111612 as a high-severity issue with a CVSS score of 8.7. This weakness, classified under CWE-321, exists in netdisk-fast-download through version 0.4.8. The application contains an endpoint at /v2/randomAuth within ParserApi that is accessible without authentication.
According to the NVD record, attackers can repeatedly call this endpoint to retrieve encrypted authentication data. The system uses a hard-coded AES key, identified as nfd_auth_key2026, to encrypt this data. Because the key is static and publicly known, adversaries can decrypt the encryptedAuth blob.
This decryption process reveals sensitive user information, including cloud-drive cookies, tokens, and passwords. The vulnerability allows the retrieval of credentials for donated netdisk accounts. The affected software is developed by qaiu. No patched version has been confirmed in the available source material.
Why it matters
Organisations using netdisk-fast-download for automated file transfers face significant credential theft risks. The unauthenticated nature of the exploit means any internet-facing instance is vulnerable. Attackers do not need valid user credentials to initiate the attack.
The exposure of cloud-drive cookies and tokens can lead to account takeover. These credentials often grant access to sensitive corporate data stored in cloud environments. The use of a hard-coded key undermines the security of the authentication mechanism.
What happens next
- Identify all instances of netdisk-fast-download running version 0.4.8 or earlier.
- Monitor network logs for repeated requests to the /v2/randomAuth endpoint.
- Rotate any cloud-drive credentials or tokens that may have been exposed.
- Isolate affected systems from the public internet until a fix is available.
Patch priority
Security teams should prioritise systems exposed to the public internet. Check whether netdisk-fast-download is running on edge servers or public-facing containers. Verify if the application has direct network access to cloud storage services. Test any isolation measures in a non-production environment first. Back up configuration files before making changes. Reduce exposure by restricting network access to the vulnerable endpoint. Monitor for unusual outbound traffic that may indicate credential exfiltration.
What to do and how to stay safe: netdisk-fast-download
- Audit your infrastructure for any deployment of netdisk-fast-download version 0.4.8 or lower.
- Implement network segmentation to prevent unauthenticated access to the ParserApi endpoint.
- Review cloud storage access logs for signs of unauthorised credential usage.
- Prepare to rotate cloud-drive tokens and passwords once a vendor update is released.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of netdisk-fast-download are affected?
Versions up to and including 0.4.8 are affected by this vulnerability.
Is there a fix available for CVE-2026-111612?
No patch or fix has been confirmed in the source material.
What is the severity rating of this vulnerability?
The CVSS score is 8.7, which is rated as high severity.
