CVE-2026-103906

HighCVSS 7.8/10Last modified Nov 12, 2026

Description

Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries.

Metrics

CVSS 4.0 7.8/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Nov 9, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1039076.5The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both thCVE-2026-1039085.4The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, andCVE-2026-1039096.1The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to ReflCVE-2026-1039116.5The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode executCVE-2026-1039124.7The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<atCVE-2026-1039137.5The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions CVE-2026-1039146.5The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including,CVE-2026-1039155.3The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versioCVE-2026-1039168.4Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspaceCVE-2026-1039176.5The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all CVE-2026-1039186.5oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCVE-2026-1039217.4GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacy
CVE-2026-103906: High severity, CVSS 7.8 | Vulnix