Netdisk-Fast-Download Exposes User Credentials via Hard-Coded Key
An unauthenticated flaw in the open-source tool allows attackers to decrypt cloud drive tokens using a static AES key embedded in the code.
Key points
- CVE-2026-111612 affects netdisk-fast-download versions up to 0.4.8.
- Attackers can retrieve credentials via the /v2/randomAuth endpoint.
- The vulnerability uses a hard-coded AES key for decryption.
The open-source utility netdisk-fast-download contains a high-severity information disclosure flaw that exposes user authentication data. According to the NVD record, the vulnerability allows unauthenticated attackers to retrieve donated cloud drive credentials. This affects environments running the software through version 0.4.8.
Root cause
The issue stems from CWE-321, a cryptographic key management weakness. The application stores a hard-coded AES key, identified as nfd_auth_key2026, within its codebase. Attackers use this static key to decrypt the encryptedAuth blob. This blob contains sensitive user data, including cloud-drive cookies, tokens, and passwords.
Attack path
An attacker targets the /v2/randomAuth endpoint in the ParserApi component. No authentication is required to access this endpoint. By repeatedly calling the interface, the adversary retrieves encrypted authentication data. Using the known hard-coded key, they decrypt the blob to recover valid session tokens or passwords for other users.
Affected versions
- netdisk-fast-download version 0.4.8
- netdisk-fast-download version 0.4.7
- netdisk-fast-download version 0.4.6
- All versions prior to 0.4.8
Mitigation
- No confirmed fix has been released yet.
- Disable the /v2/randomAuth endpoint if possible.
- Rotate exposed cloud drive credentials immediately.
- Monitor for unauthorized access patterns.
Detection notes
Teams usually review web server access logs for repeated requests to specific API endpoints. Look for high-frequency calls to authentication-related paths from unknown IP addresses. Check whether the application is exposing encrypted blobs that are subsequently decrypted. Monitor for unusual outbound traffic that suggests data exfiltration of credential material. Inspect network flows for connections to cloud drive services using tokens that were not issued through standard login flows. Review application logs for errors related to decryption failures or key mismatches. Ensure that logging captures both request headers and response sizes to identify bulk data retrieval attempts.
Background: Data exfiltration
Data exfiltration prevention requires monitoring outbound traffic for anomalies, restricting user permissions through strict access controls, and encrypting sensitive files at rest. You must detect unusual data movement patterns early, block unauthorized transfer methods, and verify that backup systems remain intact to limit exposure during a breach.
Read the full guide: Data Exfiltration Prevention: Stop Hidden Data Theft Before It Escapes
What to do and how to stay safe: netdisk-fast-download
- Audit your infrastructure for any instances of netdisk-fast-download.
- Check if the software is running version 0.4.8 or earlier.
- Monitor logs for unauthenticated access to the randomAuth endpoint.
- Prepare to rotate cloud credentials once the vendor provides an update.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-111612?
It is a high-severity information disclosure vulnerability in netdisk-fast-download that allows unauthenticated credential theft.
Which versions are affected?
The flaw affects netdisk-fast-download through version 0.4.8.
Is there a patch available?
No fix has been confirmed yet according to the source material.
