---
id: "CVE-2026-111494"
page: "https://infrastack.ai/live/CVE-2026-111494"
kind: "vulnerability"
aliases: ["CVE-2026-111494"]
title: "MatchPoint Android app: accepts any TLS certificate, exposing credentials and data"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "MatchPoint Android app", "fixed": [], "affected": "unknown", "ecosystem": "android"}]
ecosystems: []
tags: ["android", "matchpoint", "mobile", "other", "tls", "tpc-software"]
not_affected_if: ["not-using-matchpoint-app"]
published_at: "2026-11-05T22:17:44+00:00"
first_seen_at: "2026-11-05T22:46:06+00:00"
updated_at: "2026-11-05T22:48:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111494", "first_seen_at": "2026-11-05T22:46:06+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint", "first_seen_at": "2026-11-05T22:48:07+00:00", "cites": ["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}]
exploit_sources: []
---

# MatchPoint Android app: accepts any TLS certificate, exposing credentials and data

Link for people: https://infrastack.ai/live/CVE-2026-111494 (this .md is for agents)

The MatchPoint Android app uses a TrustManager that accepts any certificate and a permissive hostname validator, and it also allows unencrypted HTTP traffic. An attacker who can intercept the victim's network traffic can read and modify communications, including credentials and personal data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:MatchPoint Android app affected unknown fixed no fixed version listed

## How to check

Check whether the MatchPoint Android app (TPC Software, sports facility management) is installed and update it to the latest version in Google Play. Affected versions are not published; the Play Store or TPC Software would settle it.

## Fix

TPC Software says to install the latest available MatchPoint Android app version (relayed by INCIBE). No specific fixed version is published; unknown.

## Timeline

- 2026-11-05T22:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111494
- 2026-11-05T22:48:07+00:00 analyst https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint — INCIBE-2026-841 (CNA coordinator, not vendor's own page) covers 7 MatchPoint (TPC Software) CVEs. No affected or fixed app version given; vendor advice is only 'install the latest available version'. Server-side fixes were deployed only for CVE-2026-111490 and -111493, so none for this one. No vendor advisory or Play Store listing found; nothing marked verified.

## Documents

- [advisory] INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

## From the sources

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_