CVE-2026-109423
Received Received - Intake

NetEase Cloud Music Windows Client TLS Certificate Validation Bypass

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109423
EUVD
EUVD-2026-97818

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
NetEase NetEase Cloud Music for Windows 3.1.38
NetEase NetEase Cloud Music for Windows 3.1.39.205426

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a TLS certificate validation flaw in NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426. It fails to properly validate server certificates, allowing attackers to intercept and decrypt HTTPS traffic via man-in-the-middle attacks. The issue includes not verifying certificate chains, hostnames, or using the Windows trust store.

Detection Guidance

To detect this vulnerability, monitor network traffic for unencrypted or improperly encrypted HTTPS sessions from the NetEase Cloud Music client. Use tools like Wireshark to inspect TLS handshakes and certificate validation failures. Check if the client accepts self-signed or rogue certificates.

Impact Analysis

An attacker could capture your MUSIC_U session credential used in API requests, leading to account takeover. They can also modify server responses during transit, enabling potential data manipulation or further attacks on your account.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to the exposure of sensitive session credentials (MUSIC_U) and potential unauthorized access to user data. Failure to properly validate TLS certificates undermines secure data transmission requirements in these regulations.

Mitigation Strategies

Immediately update the NetEase Cloud Music client to the latest patched version. Disable the application until an update is applied. Use a network firewall to block suspicious traffic. Monitor for unauthorized account access or modified responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109423. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart