{"id":"CVE-2026-111494","kind":"vulnerability","aliases":["CVE-2026-111494"],"related":[],"title":"MatchPoint Android app: accepts any TLS certificate, exposing credentials and data","description":"Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.","summary":"The MatchPoint Android app uses a TrustManager that accepts any certificate and a permissive hostname validator, and it also allows unencrypted HTTP traffic. An attacker who can intercept the victim's network traffic can read and modify communications, including credentials and personal data.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MatchPoint Android app","fixed":[],"affected":"unknown","ecosystem":"android"}],"ecosystems":[],"tags":["android","matchpoint","mobile","other","tls","tpc-software"],"not_affected_if":["not-using-matchpoint-app"],"how_to_check":"Check whether the MatchPoint Android app (TPC Software, sports facility management) is installed and update it to the latest version in Google Play. Affected versions are not published; the Play Store or TPC Software would settle it.","fix":"TPC Software says to install the latest available MatchPoint Android app version (relayed by INCIBE). No specific fixed version is published; unknown.","status":"open","published_at":"2026-11-05T22:17:44+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:31+00:00","updated_at":"2026-11-05T22:48:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T22:46:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MatchPoint Android app: accepts any TLS certificate, exposing credentials and data","impact":"high","summary":"The MatchPoint Android app uses a TrustManager that accepts any certificate and a permissive hostname validator, and it also allows unencrypted HTTP traffic. An attacker who can intercept the victim's network traffic can read and modify communications, including credentials and personal data.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","mobile"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Credentials and personal data readable and modifiable by a network attacker","analyst_note":"Find the affected MatchPoint Android app versions, whether a fixed release exists, and the vendor advisory, since the NVD entry alone gives no versions or fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-matchpoint-app"],"who_is_affected":"Users of the MatchPoint Android app on networks where traffic can be intercepted, such as public Wi-Fi or a compromised network. The sources do not say which app versions are affected or whether a fixed version exists.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000658,"input_tokens":4236,"output_tokens":468,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected MatchPoint Android app versions, whether a fixed release exists, and the vendor advisory, since the NVD entry alone gives no versions or fix.","search":"'-111494':14A,17A '-2026':13A,16A 'accept':4A,37B,87C 'addit':95C 'allow':48B,98C 'also':47B 'android':2A,19A,21B,31B,80C 'app':3A,20A,32B,81C,97C 'attack':53B,103C 'capabl':104C 'certif':7A,39B,76C,89C 'communic':66B,115C 'could':111C 'credenti':9A,68B,117C 'cve':12A,15A 'data':11A,71B,120C 'due':82C 'expos':8A 'hostnam':43B,93C 'http':50B,100C 'includ':67B,116C 'incorrect':72C 'intercept':56B,106C 'matchpoint':1A,18A,22B,30B,79C 'mobil':23B 'modifi':65B,114C 'network':60B 'permiss':42B,92C 'person':70B,119C 'read':63B,112C 'softwar':28B 'tls':6A,25B,75C 'tpc':27B 'tpc-softwar':26B 'traffic':51B,61B,101C,110C 'trustmanag':35B,85C 'unencrypt':49B,99C 'use':33B 'valid':44B,73C,94C 'victim':58B,108C","nicknames":[],"mitigations":[],"who_affected":"People who use the MatchPoint Android app from TPC Software, a sports facility management platform. An attacker who can intercept the network traffic (for example on public Wi-Fi or a hostile network) can read and modify traffic, including logins and personal data, because the app accepts any TLS certificate and permits plain HTTP. Users of other apps, or of MatchPoint only through a browser, are not covered by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Update the MatchPoint app to the newest version in Google Play, and avoid public Wi-Fi when using it until you have.","pkeys":["androidapp","matchpointandroidapp"],"ptokens":["android","app","matchpoint"],"labels":["android","critical","matchpoint","mobile","other","tls","tpcsoftware"],"campaign_type":null,"first_public_at":"2026-11-05T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111494","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111494","severity":null,"published_at":"2026-11-05T22:17:44+00:00","modified_at":"2026-11-05T22:36:02+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111494:1834","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","severity":null,"published_at":"2026-11-05T22:48:07+00:00","modified_at":"2026-11-05T22:48:07+00:00","first_seen_at":"2026-11-05T22:48:07+00:00","fetched_at":"2026-11-05T22:48:07+00:00","note":"INCIBE-2026-841 (CNA coordinator, not vendor's own page) covers 7 MatchPoint (TPC Software) CVEs. No affected or fixed app version given; vendor advice is only 'install the latest available version'. Server-side fixes were deployed only for CVE-2026-111490 and -111493, so none for this one. No vendor advisory or Play Store listing found; nothing marked verified.","cites":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}],"documents":[{"id":81214,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","title":"INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}