---
id: "CVE-2026-111495"
page: "https://infrastack.ai/live/CVE-2026-111495"
kind: "vulnerability"
aliases: ["CVE-2026-111495"]
title: "MatchPoint Android app: embedded API keys and config extractable from APK"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "matchpoint", "other"]
not_affected_if: ["unknown"]
published_at: "2026-11-05T22:17:44+00:00"
first_seen_at: "2026-11-05T22:46:06+00:00"
updated_at: "2026-11-05T22:46:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111495", "first_seen_at": "2026-11-05T22:46:06+00:00"}]
exploit_sources: []
---

# MatchPoint Android app: embedded API keys and config extractable from APK

Link for people: https://infrastack.ai/live/CVE-2026-111495 (this .md is for agents)

The MatchPoint Android app ships API keys, credentials and configuration parameters inside its APK, where anyone can extract them by reverse engineering. The vendor says these are project identifiers rather than authentication secrets, so the real impact depends on what each exposed key is allowed to do.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Decompile your own MatchPoint APK build and search for API keys or config values to see what is exposed.

## Timeline

- 2026-11-05T22:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111495

## From the sources

API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_