---
id: "CVE-2026-111489"
page: "https://infrastack.ai/live/CVE-2026-111489"
kind: "vulnerability"
aliases: ["CVE-2026-111489"]
title: "MatchPoint mobile app: embedded static credential grants unauthenticated API access"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "MatchPoint", "fixed": [], "affected": "unknown (INCIBE lists only the MatchPoint platform)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["api", "hardcoded-credentials", "matchpoint", "mobile-app", "other", "tpc-software"]
not_affected_if: ["unknown"]
published_at: "2026-11-05T22:17:43+00:00"
first_seen_at: "2026-11-05T22:46:05+00:00"
updated_at: "2026-11-05T22:47:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111489", "first_seen_at": "2026-11-05T22:46:05+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint", "first_seen_at": "2026-11-05T22:47:55+00:00", "cites": ["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}]
exploit_sources: []
---

# MatchPoint mobile app: embedded static credential grants unauthenticated API access

Link for people: https://infrastack.ai/live/CVE-2026-111489 (this .md is for agents)

The MatchPoint mobile app contains a static credential that the platform accepts to return an 'autorizado' token. According to the report, that token grants unauthenticated access to the platform's API services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MatchPoint affected unknown (INCIBE lists only the MatchPoint platform) fixed no fixed version listed

## How to check

No published version range. Check whether you run or operate the TPC Software MatchPoint platform or its mobile app. Update the app to the latest release and ask TPC Software whether the static credential was removed or rotated.

## Fix

TPC Software (via INCIBE) recommends installing the latest available MatchPoint app version. No fixed version number is published, and the server-side fixes are named only for CVE-2026-111490 and CVE-2026-111493, not this CVE.

## Timeline

- 2026-11-05T22:46:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111489
- 2026-11-05T22:47:55+00:00 analyst https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint — Read INCIBE-CERT coordinated notice INCIBE-2026-841 (TPC Software MatchPoint, 7 CVEs, reporter Sergi García Tárraga). It is the coordinator's page, relaying vendor measures, not the vendor's own advisory; nothing marked verified. No versions published; vendor says install latest app version (server-side fixes named only for CVE-2026-111490 and -111493). No exploitation noted by INCIBE; no PoC found.

## Documents

- [advisory] INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

## From the sources

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_