MATCHPOINT · CVE-2026-111489 · Other
NO FIX YET · SEE WHAT TO DO
The MatchPoint mobile app contains a static credential that the platform accepts to return an 'autorizado' token. According to the report, that token grants unauthenticated access to the platform's API services.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
TPC Software's MatchPoint, a sports facility management platform, is affected through its mobile app, which embeds a static credential that the platform accepts in return for an 'autorizado' token. Per the report, that token gives unauthenticated access to the API services. Sports clubs and facilities that run MatchPoint, and their members, should look at this; others can skip it. INCIBE lists no affected versions.
Not affected if unknown
Who cares api, hardcoded-credentials, matchpoint, mobile-app, tpc-software
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.