Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities by TPC Software
CVE-2026-111495 (GCVE-0-2026-111495)
Vulnerability from nvd – Published: 2026-11-05 21:59 – Updated: 2026-11-05 21:59
VLAI
EPSS
VEX
Title
API keys, credentials, and configuration parameters embedded in the MatchPoint APK
Summary
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:59
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element."
}
],
"value": "API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:59:47.856Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "API keys, credentials, and configuration parameters embedded in the MatchPoint APK",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111495",
"datePublished": "2026-11-05T21:59:47.856Z",
"dateReserved": "2026-10-16T09:54:35.040Z",
"dateUpdated": "2026-11-05T21:59:47.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111494 (GCVE-0-2026-111494)
Vulnerability from nvd – Published: 2026-11-05 21:58 – Updated: 2026-11-05 21:58
VLAI
EPSS
VEX
Title
Incorrect validation of TLS certificates in the MatchPoint Android app
Summary
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
Severity
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim\u0027s traffic could read and modify communications, including credentials and personal data."
}
],
"value": "Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim\u0027s traffic could read and modify communications, including credentials and personal data."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:58:02.432Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incorrect validation of TLS certificates in the MatchPoint Android app",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111494",
"datePublished": "2026-11-05T21:58:02.432Z",
"dateReserved": "2026-10-16T09:54:33.846Z",
"dateUpdated": "2026-11-05T21:58:02.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111493 (GCVE-0-2026-111493)
Vulnerability from nvd – Published: 2026-11-05 21:56 – Updated: 2026-11-05 21:56
VLAI
EPSS
VEX
Title
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
Summary
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:55
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:55:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users\u0027 photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform."
}
],
"value": "Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users\u0027 photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:56:17.098Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111493",
"datePublished": "2026-11-05T21:56:17.098Z",
"dateReserved": "2026-10-16T09:54:32.424Z",
"dateUpdated": "2026-11-05T21:56:17.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111492 (GCVE-0-2026-111492)
Vulnerability from nvd – Published: 2026-11-05 21:53 – Updated: 2026-11-05 21:53
VLAI
EPSS
VEX
Title
SQL injection in the push notification handler of the MatchPoint Android app
Summary
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
Severity
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device."
}
],
"value": "SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:53:32.301Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SQL injection in the push notification handler of the MatchPoint Android app",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111492",
"datePublished": "2026-11-05T21:53:32.301Z",
"dateReserved": "2026-10-16T09:54:32.042Z",
"dateUpdated": "2026-11-05T21:53:32.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111491 (GCVE-0-2026-111491)
Vulnerability from nvd – Published: 2026-11-05 21:51 – Updated: 2026-11-05 21:51
VLAI
EPSS
VEX
Title
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
Summary
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
Severity
CWE
- CWE-256 - Plaintext storage of a password
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:50
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app\u0027s SharedPreferences. An attacker with access to the device\u0027s local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform."
}
],
"value": "Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app\u0027s SharedPreferences. An attacker with access to the device\u0027s local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext storage of a password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:51:47.817Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app\u0027s SharedPreferences",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111491",
"datePublished": "2026-11-05T21:51:47.817Z",
"dateReserved": "2026-10-16T09:54:32.023Z",
"dateUpdated": "2026-11-05T21:51:47.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111490 (GCVE-0-2026-111490)
Vulnerability from nvd – Published: 2026-11-05 21:49 – Updated: 2026-11-05 21:49
VLAI
EPSS
VEX
Title
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Summary
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
Severity
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:48
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:48:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester\u0027s authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances."
}
],
"value": "Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester\u0027s authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:49:40.608Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure direct object reference (IDOR) vulnerability in the MatchPoint API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111490",
"datePublished": "2026-11-05T21:49:40.608Z",
"dateReserved": "2026-10-16T09:54:29.941Z",
"dateUpdated": "2026-11-05T21:49:40.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111489 (GCVE-0-2026-111489)
Vulnerability from nvd – Published: 2026-11-05 21:47 – Updated: 2026-11-05 21:47
VLAI
EPSS
VEX
Title
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
Summary
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:42
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A static credential embedded in the mobile app has been reported to return the \u0027autorizado\u0027 token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services."
}
],
"value": "A static credential embedded in the mobile app has been reported to return the \u0027autorizado\u0027 token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:47:37.430Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "A static credential embedded in the mobile app has been reported to return the \u0027autorizado\u0027 token on the MatchPoint platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111489",
"datePublished": "2026-11-05T21:47:37.430Z",
"dateReserved": "2026-10-16T09:54:29.921Z",
"dateUpdated": "2026-11-05T21:47:37.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111495 (GCVE-0-2026-111495)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:59 – Updated: 2026-11-05 21:59
VLAI
EPSS
VEX
Title
API keys, credentials, and configuration parameters embedded in the MatchPoint APK
Summary
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:59
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element."
}
],
"value": "API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:59:47.856Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "API keys, credentials, and configuration parameters embedded in the MatchPoint APK",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111495",
"datePublished": "2026-11-05T21:59:47.856Z",
"dateReserved": "2026-10-16T09:54:35.040Z",
"dateUpdated": "2026-11-05T21:59:47.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111494 (GCVE-0-2026-111494)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:58 – Updated: 2026-11-05 21:58
VLAI
EPSS
VEX
Title
Incorrect validation of TLS certificates in the MatchPoint Android app
Summary
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
Severity
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim\u0027s traffic could read and modify communications, including credentials and personal data."
}
],
"value": "Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim\u0027s traffic could read and modify communications, including credentials and personal data."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:58:02.432Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incorrect validation of TLS certificates in the MatchPoint Android app",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111494",
"datePublished": "2026-11-05T21:58:02.432Z",
"dateReserved": "2026-10-16T09:54:33.846Z",
"dateUpdated": "2026-11-05T21:58:02.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111493 (GCVE-0-2026-111493)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:56 – Updated: 2026-11-05 21:56
VLAI
EPSS
VEX
Title
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
Summary
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:55
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:55:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users\u0027 photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform."
}
],
"value": "Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users\u0027 photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:56:17.098Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111493",
"datePublished": "2026-11-05T21:56:17.098Z",
"dateReserved": "2026-10-16T09:54:32.424Z",
"dateUpdated": "2026-11-05T21:56:17.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111492 (GCVE-0-2026-111492)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:53 – Updated: 2026-11-05 21:53
VLAI
EPSS
VEX
Title
SQL injection in the push notification handler of the MatchPoint Android app
Summary
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
Severity
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device."
}
],
"value": "SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:53:32.301Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SQL injection in the push notification handler of the MatchPoint Android app",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111492",
"datePublished": "2026-11-05T21:53:32.301Z",
"dateReserved": "2026-10-16T09:54:32.042Z",
"dateUpdated": "2026-11-05T21:53:32.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111491 (GCVE-0-2026-111491)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:51 – Updated: 2026-11-05 21:51
VLAI
EPSS
VEX
Title
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
Summary
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
Severity
CWE
- CWE-256 - Plaintext storage of a password
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:50
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app\u0027s SharedPreferences. An attacker with access to the device\u0027s local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform."
}
],
"value": "Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app\u0027s SharedPreferences. An attacker with access to the device\u0027s local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext storage of a password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:51:47.817Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app\u0027s SharedPreferences",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111491",
"datePublished": "2026-11-05T21:51:47.817Z",
"dateReserved": "2026-10-16T09:54:32.023Z",
"dateUpdated": "2026-11-05T21:51:47.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111490 (GCVE-0-2026-111490)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:49 – Updated: 2026-11-05 21:49
VLAI
EPSS
VEX
Title
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Summary
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
Severity
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:48
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:48:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester\u0027s authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances."
}
],
"value": "Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester\u0027s authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:49:40.608Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure direct object reference (IDOR) vulnerability in the MatchPoint API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111490",
"datePublished": "2026-11-05T21:49:40.608Z",
"dateReserved": "2026-10-16T09:54:29.941Z",
"dateUpdated": "2026-11-05T21:49:40.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111489 (GCVE-0-2026-111489)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:47 – Updated: 2026-11-05 21:47
VLAI
EPSS
VEX
Title
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
Summary
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TPC Software | Matchpoint |
Affected:
Versions prior to latest one
cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:* |
Date Public
2026-11-05 21:42
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matchpoint",
"vendor": "TPC Software",
"versions": [
{
"status": "affected",
"version": "Versions prior to latest one"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sergi Garc\u00eda T\u00e1rraga"
}
],
"datePublic": "2026-11-05T21:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A static credential embedded in the mobile app has been reported to return the \u0027autorizado\u0027 token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services."
}
],
"value": "A static credential embedded in the mobile app has been reported to return the \u0027autorizado\u0027 token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:47:37.430Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "A static credential embedded in the mobile app has been reported to return the \u0027autorizado\u0027 token on the MatchPoint platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111489",
"datePublished": "2026-11-05T21:47:37.430Z",
"dateReserved": "2026-10-16T09:54:29.921Z",
"dateUpdated": "2026-11-05T21:47:37.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}