CVE-2026-111495
Deferred
Deferred - Pending Action
MatchPoint APK Hard-Coded Credentials Exposure
Vulnerability report for CVE-2026-111495, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-05
Last updated on: 2026-11-05
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
