NetEase Cloud Music for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 fails to validate TLS certificates. This flaw, a CWE-295 improper certificate validation, allows an attacker on the same network to intercept HTTPS traffic, capture the MUSIC_U session credential sent in authenticated API requests, and tamper with responses. The result is possible account takeover and transport‑layer response forgery.

The affected systems are NetEase Cloud Music for Windows for the two builds mentioned above: 3.1.38 and 3.1.39.205426. No other versions or operating systems are listed.

The CVSS score of 9.1 signals that this flaw can have substantial impact if exploited. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog. An attacker with network proximity can present a rogue certificate authority to the client, bypass the missing hostname and chain checks, and perform a man‑in‑the‑middle attack. Legal pre‑requisites are minimal: the attacker needs to be able to inject traffic toward the client. The weakness remains active until the client is updated to include proper server identity verification.