Embedded credentials in TPC Software Matchpoint APK
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Versions of the TPC Software Matchpoint APK prior to the latest one embed API keys, credentials and configuration parameters. A local attacker without privileges can extract them through reverse engineering of the app. The vendor considers these values project identifiers rather than authentication secrets, and the impact depends on the capabilities and restrictions of each exposed element.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one | — | No fix listed | CNA |
- Matchpoint VendorTPC Software Affected Versions prior to latest one Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Matchpoint.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-11-05 Threatist record created from CVE-2026-111495
- 2026-11-06 Alias added: GHSA-965g-9cqv-fwmx
References
More TPC Software vulnerabilities
- TI-2026-85678 Insecure direct object reference in TPC Software Matchpoint API CVSS 4.0CRITICAL 9.9
- TI-2026-85677 Static credential in Matchpoint app grants unauthenticated API access CVSS 4.0CRITICAL 9.9
- TI-2026-85689 Incorrect TLS certificate checks in MatchPoint Android app CVSS 4.0CRITICAL 9.1
- TI-2026-85688 Unauthenticated access in MatchPoint exposes user profile photos CVSS 4.0HIGH 8.7
- TI-2026-85680 SQL injection in the MatchPoint Android app push handler CVSS 4.0HIGH 8.6
- TI-2026-85679 MatchPoint stores credentials in plaintext in SQLite and SharedPreferences CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-111495 · CVE Program
- CVE-2026-111495 · NVD
- FIRST EPSS
- GHSA-965g-9cqv-fwmx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences