CVE-2026-111491
Deferred
Deferred - Pending Action
Plain Text Credentials Stored in MatchPoint Android App
Vulnerability report for CVE-2026-111491, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-05
Last updated on: 2026-11-05
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
