by Kastro
Paper/Archive/CVE-2026-111494

CVE-2026-111494

TPC Software Matchpoint — Incorrect validation of TLS certificates in the MatchPoint Android app

CVSS 9.1
critical.is priorityof 100
27
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

Affected

ProductAffectedFixed inSource
MatchpointVersions prior to latest one–CNA

Scores by source

INCIBE (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

refincibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint