CVE-2026-109424
NetEase Cloud Music Weak Encryption via eapi/xeapi
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.
| CWE | CWE-321 |
| Vendor | netease |
| Product | netease cloud music for windows |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for netease netease cloud music for windows
Be the first to know when new medium vulnerabilities affecting netease netease cloud music for windows are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
NetEase / NetEase Cloud Music for Windows
3.1.38 3.1.39.205426
References
Credits
LeoWSY-hashblue