CVE-2026-111491
Last modified
CVE-2026-111491 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform..
Description
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111491?
How severe is CVE-2026-111491?
How do I fix CVE-2026-111491?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11148Inappropriate implementation in Payments in Google Chrome on…6.5
- CVE-2026-111486Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-111487An out-of-bounds write vulnerability in the Qt Framework ass…4.3
- CVE-2026-111489A static credential embedded in the mobile app has been repo…9.9
- CVE-2026-11149Insufficient validation of untrusted input in Extensions in …7.5
- CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the…9.9
- CVE-2026-111492SQL injection in the push notification handler of the MatchP…8.6
- CVE-2026-111493Lack of authentication and authorization in the Images.ashx …8.7
- CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint A…9.1
- CVE-2026-111495API keys, credentials, and configuration parameters embedded…5.1
- CVE-2026-111496Kafka Streams derives its stream-time clock from record time…9.1
- CVE-2026-111497A buffer overflow vulnerability in the Brotli decoder (c/dec…9.8
Are you affected by CVE-2026-111491?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST