CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app

CriticalCVSS 9.1

Published: 2026-11-05 23:58
Updated: 2026-11-10 19:02
Exploit status: No public exploit known

Description

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

Affected products

Product	Affected versions	Fixed in
TPC Software Matchpoint	= Versions prior to latest one	No fix listed

References

www.incibe.es

CVSS v4.0

9.1 Critical

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: High
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-295 Improper certificate validation

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.