{"id":"CVE-2026-111495","kind":"vulnerability","aliases":["CVE-2026-111495"],"related":[],"title":"MatchPoint Android app: embedded API keys and config extractable from APK","description":"API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.","summary":"The MatchPoint Android app ships API keys, credentials and configuration parameters inside its APK, where anyone can extract them by reverse engineering. The vendor says these are project identifiers rather than authentication secrets, so the real impact depends on what each exposed key is allowed to do.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","matchpoint","other"],"not_affected_if":["unknown"],"how_to_check":"- Decompile your own MatchPoint APK build and search for API keys or config values to see what is exposed.","fix":null,"status":"open","published_at":"2026-11-05T22:17:44+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:42+00:00","updated_at":"2026-11-05T22:46:42+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T22:46:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MatchPoint Android app: embedded API keys and config extractable from APK","impact":"low","summary":"The MatchPoint Android app ships API keys, credentials and configuration parameters inside its APK, where anyone can extract them by reverse engineering. The vendor says these are project identifiers rather than authentication secrets, so the real impact depends on what each exposed key is allowed to do.","audience":"everyone","category":"other","nicknames":[],"who_cares":["matchpoint","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"exposed keys could be misused depending on their restrictions","analyst_note":"Check the vendor advisory or NVD entry for affected MatchPoint versions, which keys are exposed, and whether they are restricted; the vendor's claim that these are non-secret identifiers is unverified.","how_to_check":"- Unknown: the sources do not list affected MatchPoint versions or which keys are embedded.\n- Decompile your own MatchPoint APK build and search for API keys or config values to see what is exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Anyone with the MatchPoint Android app installed can have its embedded values pulled out of the APK by reverse engineering. The sources do not say which versions are affected or what the exposed keys can access, so the real exposure depends on each key's restrictions.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4245,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111495':14A,17A '-2026':13A,16A 'allow':64B 'android':2A,18B,22B 'anyon':35B 'api':5A,25B,65C 'apk':11A,33B,75C 'app':3A,23B 'authent':51B,108C 'capabl':115C 'client':100C 'config':8A 'configur':29B,69C 'consid':103C 'credenti':27B,67C 'cve':12A,15A 'depend':57B,112C 'distinguish':85C 'element':88C,121C 'embed':4A,71C 'engin':41B,82C 'expos':61B,120C 'extract':9A,37B,79C,87C 'firebas':93C 'googl':90C 'identifi':48B,106C 'impact':56B,111C 'insid':31B 'key':6A,26B,62B,66C,94C 'map':91C 'matchpoint':1A,19B,21B,74C 'must':96C 'paramet':30B,70C 'project':47B,105C 'rather':49B 'real':55B 'remain':97C 'restrict':117C 'revers':40B,81C 'say':44B 'secret':52B,109C 'ship':24B 'side':101C 'vendor':43B,84C","nicknames":[],"mitigations":[],"who_affected":"Anyone with the MatchPoint Android app installed can have its embedded values pulled out of the APK by reverse engineering. The sources do not say which versions are affected or what the exposed keys can access, so the real exposure depends on each key's restrictions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","matchpoint","medium","other"],"campaign_type":null,"first_public_at":"2026-11-05T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111495","severity":null,"published_at":"2026-11-05T22:17:44+00:00","modified_at":"2026-11-05T22:36:02+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}