CVE-2026-111495: falha de média gravidade em TPC Software Matchpoint
API keys, credentials, and configuration parameters embedded in the MatchPoint APK
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.1%
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TPC Software · MatchpointCVEs relacionadas — TPC Software Matchpoint
No mesmo produto, das mais perigosas para as menos.
CVE-2026-111493HIGHLack of authentication and authorization in the Images.ashx endpoint in MatchPointEPSS 0.5%CVE-2026-111490CRITICALInsecure direct object reference (IDOR) vulnerability in the MatchPoint APIEPSS 0.4%CVE-2026-111489CRITICALA static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platformEPSS 0.3%CVE-2026-111494CRITICALIncorrect validation of TLS certificates in the MatchPoint Android appEPSS 0.2%CVE-2026-111492HIGHSQL injection in the push notification handler of the MatchPoint Android appEPSS 0.2%CVE-2026-111491MEDIUMCredentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesEPSS 0.1%