Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

NetEase Cloud Music Windows client allows traffic interception

CVE-2026-109423 · published today
Summary

The NetEase Cloud Music application for Windows (versions 3.1.38 and 3.1.39.205426) does not properly check the security certificates of the sites it connects to. This weakness lets a nearby attacker pretend to be the service, read and change the data being sent, and potentially steal login credentials. Update the application to a newer version or apply the vendor's patch to restore proper certificate verification.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netease netease cloud music for windows 3.1.38
Original advisory text
NetEase Cloud Music TLS Certificate Validation Bypass
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-295Improper Certificate Validation
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109423 · NVD
CVE-2026-109423 · MITRE
Track software like this
Free during beta