Read the docs
TI-2026-79183 Aliases CVE-2026-114219GHSA-q6g4-8jxr-rp9c

Hard-coded key in NewType Infortech NT OneAPP exposes login data

Priority MEDIUM 41CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

NewType Infortech NT OneAPP from 0 through 1.5.22 contains hard-coded credentials. The app ships with a hard-coded cryptographic key (CWE-798). An unauthenticated remote attacker who obtains this key can decrypt login requests and read users' plaintext account credentials and device information.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NewType InfortechNT OneAPPup to 1.5.22—No fix listedCNA
  • NT OneAPP VendorNewType Infortech Affected up to 1.5.22 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for NT OneAPP.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114219
  2. 2026-10-22 Alias added: GHSA-q6g4-8jxr-rp9c
  3. 2026-10-22 CISA SSVC decision points changed
  4. 2026-10-22 Priority changed: MEDIUM → LOW
  5. 2026-10-23 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2025-09422 NewType Infortech｜NUP Portal - SQL Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-79184 Improper certificate validation in NewType Infortech NT OneAPP CVSS 4.0CRITICAL 9.3
  • TI-2025-09423 NewType Infortech｜NUP Portal - Missing Authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-79186 Authentication bypass in NewType Infortech NT OneAPP CVSS 4.0MEDIUM 6.9
  • TI-2026-79187 Sensitive information exposure in NewType Infortech NT OneAPP backups CVSS 4.0MEDIUM 6.7
  • TI-2026-79185 Credential disclosure in NewType Infortech NT OneAPP CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences