netdisk-fast-download through version 0.4.8 allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint. By calling the endpoint repeatedly, an attacker can decrypt the encryptedAuth blob using the hard‑coded AES key nfd_auth_key2026 and recover other users' cloud‑drive cookies, tokens, or passwords. This results in a disclosure of sensitive account information, enabling unauthorized access to the affected users’ cloud storage services.

The vulnerability is present in the qaiu netdisk‑fast‑download application, specifically in the ParserApi component of version 0.4.8 (and any build that includes the same unmodified code). Clients running this version expose the /v2/randomAuth endpoint without authentication, allowing external users to exploit the flaw.

The CVSS score of 8.7 marks this flaw as high severity, and although the EPSS score is not available, the lack of an authentication requirement and the straightforward exploitation path make it likely to be targeted. It is not yet listed in CISA's KEV catalog, but its potential to compromise numerous user accounts should prompt immediate remediation or mitigation.