{"id":"CVE-2026-111489","kind":"vulnerability","aliases":["CVE-2026-111489"],"related":[],"title":"MatchPoint mobile app: embedded static credential grants unauthenticated API access","description":"A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.","summary":"The MatchPoint mobile app contains a static credential that the platform accepts to return an 'autorizado' token. According to the report, that token grants unauthenticated access to the platform's API services.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MatchPoint","fixed":[],"affected":"unknown (INCIBE lists only the MatchPoint platform)","ecosystem":"vendor"}],"ecosystems":[],"tags":["api","hardcoded-credentials","matchpoint","mobile-app","other","tpc-software"],"not_affected_if":["unknown"],"how_to_check":"No published version range. Check whether you run or operate the TPC Software MatchPoint platform or its mobile app. Update the app to the latest release and ask TPC Software whether the static credential was removed or rotated.","fix":"TPC Software (via INCIBE) recommends installing the latest available MatchPoint app version. No fixed version number is published, and the server-side fixes are named only for CVE-2026-111490 and CVE-2026-111493, not this CVE.","status":"open","published_at":"2026-11-05T22:17:43+00:00","first_seen_at":"2026-11-05T22:46:05+00:00","triaged_at":"2026-11-05T22:46:31+00:00","updated_at":"2026-11-05T22:47:55+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T22:46:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MatchPoint mobile app: embedded static credential grants unauthenticated API access","impact":"high","summary":"The MatchPoint mobile app contains a static credential that the platform accepts to return an 'autorizado' token. According to the report, that token grants unauthenticated access to the platform's API services.","audience":"businesses","category":"other","nicknames":[],"who_cares":["matchpoint","mobile-app","api"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attackers obtain API access to platform services","analyst_note":"Only the NVD entry is cited and it gives no affected versions, vendor advisory or fix; find the vendor statement and confirm the scope of the MatchPoint platform affected.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The report concerns the MatchPoint platform's mobile app and its API, with a hardcoded credential that yields an access token. Teams that run or integrate with MatchPoint should look at whether their deployment uses that app or API. The sources do not say which versions or deployments are affected, or whether a vendor fix has shipped.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000655,"input_tokens":4183,"output_tokens":474,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Only the NVD entry is cited and it gives no affected versions, vendor advisory or fix; find the vendor statement and confirm the scope of the MatchPoint platform affected.","search":"'-111489':13A,16A '-2026':12A,15A 'accept':41B 'access':10A,55B,90C 'accord':47B 'api':9A,18B,60B,92C 'app':3A,25B,33B,69C 'autorizado':45B,76C 'contain':34B 'credenti':6A,21B,37B,64C 'cve':11A,14A 'embed':4A,65C 'grant':7A,53B,88C 'hardcod':20B 'hardcoded-credenti':19B 'matchpoint':1A,17A,22B,31B,80C 'mobil':2A,24B,32B,68C 'mobile-app':23B 'platform':40B,58B,81C 'report':50B,72C,83C 'return':43B,74C 'servic':61B,93C 'softwar':29B 'state':84C 'static':5A,36B,63C 'token':46B,52B,77C,87C 'tpc':28B 'tpc-softwar':27B 'unauthent':8A,54B,89C","nicknames":[],"mitigations":[],"who_affected":"TPC Software's MatchPoint, a sports facility management platform, is affected through its mobile app, which embeds a static credential that the platform accepts in return for an 'autorizado' token. Per the report, that token gives unauthenticated access to the API services. Sports clubs and facilities that run MatchPoint, and their members, should look at this; others can skip it. INCIBE lists no affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["matchpoint"],"ptokens":["matchpoint"],"labels":["api","critical","hardcodedcredentials","matchpoint","mobileapp","other","tpcsoftware"],"campaign_type":null,"first_public_at":"2026-11-05T22:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111489","severity":null,"published_at":"2026-11-05T22:17:43+00:00","modified_at":"2026-11-05T22:36:02+00:00","first_seen_at":"2026-11-05T22:46:05+00:00","fetched_at":"2026-11-05T22:46:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111489:1836","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","severity":null,"published_at":"2026-11-05T22:47:55+00:00","modified_at":"2026-11-05T22:47:55+00:00","first_seen_at":"2026-11-05T22:47:55+00:00","fetched_at":"2026-11-05T22:47:55+00:00","note":"Read INCIBE-CERT coordinated notice INCIBE-2026-841 (TPC Software MatchPoint, 7 CVEs, reporter Sergi García Tárraga). It is the coordinator's page, relaying vendor measures, not the vendor's own advisory; nothing marked verified. No versions published; vendor says install latest app version (server-side fixes named only for CVE-2026-111490 and -111493). No exploitation noted by INCIBE; no PoC found.","cites":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}],"documents":[{"id":81214,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","title":"INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}