Qaiu vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Qaiu products: 1 record(s), with severity, exploitation and fixes.

Netdisk-fast-download 1

Exploited only (KEV) →

CVE-2026-111612 High · 7.5 CWE-321 Oct 16, 2026

netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.