CVE-2026-111495 · Other
NO FIX YET
The MatchPoint Android app ships API keys, credentials and configuration parameters inside its APK, where anyone can extract them by reverse engineering. The vendor says these are project identifiers rather than authentication secrets, so the real impact depends on what each exposed key is allowed to do.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone with the MatchPoint Android app installed can have its embedded values pulled out of the APK by reverse engineering. The sources do not say which versions are affected or what the exposed keys can access, so the real exposure depends on each key's restrictions.
Not affected if unknown
Who cares android, matchpoint
No fix yet, per the sources.
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.