CVE-2026-119736highCWE-798

CVE-2026-119736: high-severity vulnerability in Petpooja Munshi

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

Published

Follow this CVE+ Monitor Munshi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Petpooja · Munshi
Related CVEs — Petpooja Munshi

In the same product, most dangerous first.

CVE-2026-119735MEDIUMMunshi XSS via Purchase Inquiry Thread RenderingEPSS —CVE-2026-119734HIGHMunshi IDOR via Purchase Inquiry Thread EndpointEPSS —CVE-2026-119733HIGHMunshi Missing Authorization in Company Deletion APIEPSS —CVE-2026-119732HIGHMunshi Broken Object Level Authorization via Invoice Deletion APIEPSS —CVE-2026-119731HIGHMunshi Payment Bypass via Unauthenticated Webhook EndpointEPSS —