CVE-2026-119736
Deferred Deferred - Pending Action

Hard-Coded Credentials in Attendo Admin Android App

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-119736

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Petpooja Munshi 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a hard-coded credentials issue in the Attendo Admin Android app (version 3.0.13 or earlier). Attackers can extract production MQTT broker credentials by decompiling the app's Flutter configuration files like production.json. These credentials allow access to the MQTT broker over TCP port 1883, enabling data exposure and message injection.

Detection Guidance

Detecting this vulnerability requires analyzing the Attendo Admin Android application APK for hard-coded credentials in configuration files like production.json or device-command files. Use tools like apktool to decompile the APK and search for MQTT broker credentials in bundled assets. Monitor network traffic for unauthorized connections to TCP port 1883 from the application.

Impact Analysis

Attackers can access sensitive employee data including attendance records, personal identifiers, photos, device telemetry, and authentication details. They may also publish unauthorized messages to these topics, leading to data breaches or manipulation of information.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if employee health-related data is exposed. It results in non-compliance with data protection requirements, risking legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Attendo Admin Android application to version 3.0.14 or later to remove hard-coded credentials. Revoke any exposed MQTT broker credentials and rotate them to prevent unauthorized access. Restrict access to the MQTT broker by implementing authentication and authorization controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...