TLS Certificate Validation Issue in NetEase Cloud Music Client for Windows

CVE-2026-109423

What is CVE-2026-109423?

The NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 has a vulnerability in its TLS certificate validation process. By failing to properly validate the server certificate chain and hostname, along with not consulting the Windows certificate trust store, the application is susceptible to man-in-the-middle (MITM) attacks. This allows network-adjacent attackers to intercept and decrypt HTTPS traffic using a rogue certificate authority. Exploiting this vulnerability can lead to the compromise of session credentials, such as the MUSIC_U token, enabling unauthorized access to user accounts and the potential for transport-layer response manipulation.

References