Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109423— NetEase Cloud Music TLS Certificate Validation Bypass

Quick assessment

Affected
NetEase NetEase Cloud Music for Windows
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

网易云音乐 Windows 客户端（cloudmusic.exe）版本 3.1.38 和 3.1.39.205426 存在 TLS 证书验证漏洞。该漏洞允许网络邻近的攻击者通过拦截和解密 HTTPS 流量，实施中间人攻击。具体原因包括：未能验证服务器证书链、未检查主机名，以及未查询 Windows 证书信任存储。 攻击者可利用伪造的证书授权机构（CA）发起中间人攻击，解密通信内容，捕获通过认证 API 请求发送的 MUSIC_U 会话凭证，并在传输过程中篡改服务器响应。此举可导致账户接管和传输层响应伪造。

CVSS 7.4 · High EPSS 0.15% · P4

Affected Version Matrix 2

VendorProduct Version RangeStatus
NetEase NetEase Cloud Music for Windows 3.1.38 affected
3.1.39.205426 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109423

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NetEase Cloud Music TLS Certificate Validation Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NetEase NetEase Cloud Music for Windows 3.1.38 -

II. Public POCs for CVE-2026-109423

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109423

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109423 (1)

Proof of Concept for CVE-2026-109423 (1)

Other References for CVE-2026-109423 (1)

Same Patch Batch · NetEase · 2026-10-12 · 3 CVEs total

CVE-2026-109422 8.1 HIGH NetEase Cloud Music RCE via os.navigateExternal IPC
CVE-2026-109424 5.9 MEDIUM NetEase Cloud Music Weak Encryption via eapi/xeapi

IV. Related Vulnerabilities

Same product: NetEase Cloud Music for Windows
Same vendor: NetEase
Same weakness: CWE-295

V. Comments for CVE-2026-109423

No comments yet

Leave a comment