CVE-2026-111489
CRITICALCVSS 9.9/10
Last modified
CVE-2026-111489 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services..
Description
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111489?
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
How severe is CVE-2026-111489?
CVE-2026-111489 has a CVSS score of 9.9/10 (CRITICAL severity).
How do I fix CVE-2026-111489?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111477Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-111478Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-111479Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-11148Inappropriate implementation in Payments in Google Chrome on…6.5
- CVE-2026-111486Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-111487An out-of-bounds write vulnerability in the Qt Framework ass…4.3
- CVE-2026-11149Insufficient validation of untrusted input in Extensions in …7.5
- CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the…9.9
- CVE-2026-111491Credentials are stored in plain text in an SQLite database a…6.9
- CVE-2026-111492SQL injection in the push notification handler of the MatchP…8.6
- CVE-2026-111493Lack of authentication and authorization in the Images.ashx …8.7
- CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint A…9.1
Are you affected by CVE-2026-111489?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST