CVE-2026-111491 · Other
NO FIX YET
The MatchPoint Android app keeps usernames and passwords unencrypted in a local SQLite database and in SharedPreferences. Someone with access to the device's files or a backup can read them and log in to the platform's accounts.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Users of the MatchPoint Android app whose device data or backups could be read by someone else. The sources do not name affected app versions or say whether a fix exists.
Not affected if ios-only-users
Who cares android, matchpoint
Unknown from the sources.
No fix yet, per the sources.
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.