The NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 decrypts responses from the /eapi/ and /xeapi/ endpoints using a fixed AES‑128‑ECB key that is publicly documented and lacks an integrity check. An attacker who can intercept or forge these responses can construct ciphertext that the client will accept as valid, allowing the injection of arbitrary API payloads. The vulnerability is a prerequisite for further exploitation, such as triggering the os.navigateExternal bridge, although the description does not guarantee that such exploitation will succeed.

NetEase Cloud Music on Windows, versions 3.1.38 and 3.1.39.205426, are the only builds with the weak decryption and are therefore vulnerable. Other builds do not implement the affected decryption routine.

The CVSS score of 8.2 indicates a high severity flaw. Because the key is publicly known and no integrity protection is applied, the attack is relatively straightforward for an attacker who can intercept or inject responses over the network. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, yet the potential to deliver forged API content is considered significant for users of the service.