CVE-2026-111489

CriticalCVSS 9.9/10Last modified Nov 10, 2026

Description

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

Metrics

CVSS 4.0 9.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
TPC SoftwareMatchpointVersions prior to latest one

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-111497.5Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisCVE-2026-1114909.9Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifyinCVE-2026-1114916.9Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access toCVE-2026-1114928.6SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and conCVE-2026-1114938.7Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using prediCVE-2026-1114949.1Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hCVE-2026-1114955.1API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The CVE-2026-1114969.1Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestaCVE-2026-1114979.8A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allowsCVE-2026-1114984.4OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local aCVE-2026-1114995.5Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low CVE-2026-11159.6A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prio
CVE-2026-111489: Critical severity, CVSS 9.9 | Vulnix