CVE-2026-111489

Deferred Deferred - Pending Action

Static Credential Leak Grants Unauthenticated API Access in MatchPoint

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-111489

Affected Vendors & Products

Vendor	Product	Version / Range
TPC Software	Matchpoint	Versions prior to latest one

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a static credential embedded in a mobile app that exposes an 'autorizado' token for the MatchPoint platform. This token allows unauthenticated access to API services, meaning attackers could exploit it without needing valid user credentials.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized API access using the static 'autorizado' token. Monitor network traffic for requests containing this token without proper authentication. Inspect mobile app traffic or server logs for suspicious API calls to the MatchPoint platform.

Impact Analysis

Unauthenticated access to API services could lead to unauthorized data exposure, manipulation of services, or further attacks on the platform. Users of the MatchPoint platform may face privacy breaches or service disruptions due to unauthorized access.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (data breaches) and HIPAA (unauthorized access to sensitive data). It undermines security controls required by these regulations.

Mitigation Strategies

Immediately revoke the embedded static credential and regenerate all API tokens. Update the mobile app to remove the hardcoded token and implement proper authentication. Audit API access logs to identify any unauthorized usage and block affected endpoints if necessary.

Hi! I’m here to help you understand CVE-2026-111489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...