Read the docs
TI-2026-79186 Aliases CVE-2026-114222GHSA-3g57-fjv2-jxx4

Authentication bypass in NewType Infortech NT OneAPP

Priority LOW 29CWE-287Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

NT OneAPP from NewType Infortech, versions from 0 through 1.5.22, contains an authentication bypass caused by improper authentication (CWE-287). An unauthenticated local attacker can bypass the App PIN lock through a Deep Link and access protected resources of a logged-in user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00144 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NewType InfortechNT OneAPPup to 1.5.22—No fix listedCNA
  • NT OneAPP VendorNewType Infortech Affected up to 1.5.22 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for NT OneAPP.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114222
  2. 2026-10-22 Alias added: GHSA-3g57-fjv2-jxx4
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed

References

Other 2

  • TI-2025-09422 NewType Infortech｜NUP Portal - SQL Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-79184 Improper certificate validation in NewType Infortech NT OneAPP CVSS 4.0CRITICAL 9.3
  • TI-2026-79183 Hard-coded key in NewType Infortech NT OneAPP exposes login data CVSS 4.0CRITICAL 9.1
  • TI-2025-09423 NewType Infortech｜NUP Portal - Missing Authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-79187 Sensitive information exposure in NewType Infortech NT OneAPP backups CVSS 4.0MEDIUM 6.7
  • TI-2026-79185 Credential disclosure in NewType Infortech NT OneAPP CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences