CVE-2026-111494

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

• CWE-295

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111489A static credential embedded in the mobile app has been repo…9.9
• CVE-2026-11149Insufficient validation of untrusted input in Extensions in …7.5
• CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the…9.9
• CVE-2026-111491Credentials are stored in plain text in an SQLite database a…6.9
• CVE-2026-111492SQL injection in the push notification handler of the MatchP…8.6
• CVE-2026-111493Lack of authentication and authorization in the Images.ashx …8.7
• CVE-2026-111495API keys, credentials, and configuration parameters embedded…5.1
• CVE-2026-111496Kafka Streams derives its stream-time clock from record time…9.1
• CVE-2026-111497A buffer overflow vulnerability in the Brotli decoder (c/dec…9.8
• CVE-2026-111498OpenManage Enterprise, versions prior to 4.8.0, contains an …4.7
• CVE-2026-111499Dell OpenManage Enterprise, versions prior to 4.8.0, contain…5.5
• CVE-2026-1115A Stored Cross-Site Scripting (XSS) vulnerability was identi…9.6