CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

CriticalCVSS 9.9

Published: 2026-11-05 23:47
Updated: 2026-11-10 16:03
Exploit status: No public exploit known

Description

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

Affected products

Product	Affected versions	Fixed in
TPC Software Matchpoint	= Versions prior to latest one	No fix listed

References

www.incibe.es

CVSS v4.0

9.9 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-798 Use of Hard-coded Credentials

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.