Paper/Archive/CVE-2026-111489

CVE-2026-111489

TPC Software Matchpoint — A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

Affected

ProductAffectedFixed inSource

MatchpointVersions prior to latest one–CNA

Scores by source

INCIBE (CNA)9.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References

refincibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint