NetEase Cloud Music Windows Client Has Critical TLS Validation Flaw

The National Vulnerability Database recorded a critical security flaw in NetEase Cloud Music for Windows that compromises the integrity of encrypted communications. The vulnerability, identified as CVE-2026-109423, allows network-adjacent attackers to intercept and decrypt HTTPS traffic by exploiting a failure in TLS certificate validation within the application.

According to the NVD record, the flaw carries a CVSS score of 9.1, placing it in the critical severity range. The issue stems from CWE-295, which describes improper verification of cryptographic signatures. In this specific case, the NetEase Cloud Music client fails to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store during the connection process.

Technical Context and Risk

This lack of validation creates a significant man-in-the-middle attack vector. An attacker positioned on the same network can present a rogue certificate authority to the client. Because the application does not verify the certificate against trusted stores, it accepts the rogue certificate and establishes an encrypted session with the attacker instead of the legitimate server.

The consequences of this interception are severe for user accounts. The NVD description notes that attackers can decrypt the traffic in transit. This allows them to capture the MUSIC_U session credential, which is sent in authenticated API requests. Once an attacker possesses this session token, they can perform account takeover actions without needing the user's password.

Furthermore, the vulnerability enables transport-layer response forgery. Because the attacker controls the connection between the client and the server, they can modify server responses before they reach the user. This could allow an attacker to inject malicious content or alter data presented by the music streaming service, although the primary risk highlighted is the theft of authentication credentials.

Affected Software Versions

The vulnerability is present in specific versions of the NetEase Cloud Music client for the Windows operating system. According to the NVD data, the affected software includes version 3.1.38 and version 3.1.39.205426. The executable file associated with this vulnerability is cloudmusic.exe.

Users running these specific builds of the application are exposed to the risk of credential theft if they connect to the service over a network where an attacker can intercept traffic. The flaw does not appear to affect other platforms or versions of the NetEase Cloud Music client based on the current NVD record. The record does not indicate whether other versions are vulnerable or if a patch has been released for the affected Windows builds.

What should you do?

Security professionals should identify systems running the affected versions of NetEase Cloud Music for Windows. Organizations with strict security policies may consider blocking the application until a vendor update is confirmed. Users should be aware that using this software on untrusted networks increases the risk of session hijacking.