{"id":"CVE-2026-114219","kind":"vulnerability","aliases":["CVE-2026-114219"],"related":[],"title":"NT OneAPP: hard-coded key lets attackers decrypt login credentials","description":"NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.","summary":"NT OneAPP, a mobile app from NewType Infortech, ships a hard-coded cryptographic key. An unauthenticated remote attacker who gets that key can decrypt login requests and read users' plaintext account passwords and device details.","severity":"critical","cvss":9.1,"epss":0.00272,"exploited":false,"exploited_at":null,"products":[{"name":"NT OneAPP","fixed":["1.5.35"],"affected":"<= 1.5.22","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hard-coded-credentials","mobile","newtype-infortech","nt-oneapp","other"],"not_affected_if":["version-1.5.35-or-later"],"how_to_check":"Find the installed NT OneAPP version: Android Settings > Apps > NT OneAPP (package tw.com.newtype.ntoneapp), or the Google Play listing; on iOS, the App Store page or Settings > General > iPhone Storage > NT OneAPP. Versions 1.5.22 and earlier are affected; 1.5.35 or later is fixed. Enterprise customers can also check their MDM app inventory.","fix":"Update NT OneAPP to 1.5.35 or later (1.5.38 is the latest Android build seen). Rotate credentials used with older versions.","status":"open","published_at":"2026-10-22T05:16:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:36+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:32:36Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade NT OneAPP to version 1.5.35 or later; versions up to 1.5.22 are affected.","reach":"internet","title":"NT OneAPP: hard-coded key lets attackers decrypt login credentials","impact":"high","summary":"NT OneAPP, a mobile app from NewType Infortech, ships a hard-coded cryptographic key. An unauthenticated remote attacker who gets that key can decrypt login requests and read users' plaintext account passwords and device details.","category":"other","who_cares":["mobile","nt-oneapp","newtype-infortech"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers read users' plaintext login credentials and device information.","analyst_note":"Confirm the fixed version 1.5.35 against the vendor advisory at the NVD link and find how users check their installed app version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-1.5.35-or-later"],"user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2965,"output_tokens":379,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version 1.5.35 against the vendor advisory at the NVD link and find how users check their installed app version.","search":"'-114219':14A,17A '-2026':13A,16A 'account':62B,100C 'app':35B 'attack':8A,49B,82C 'code':5A,22B,43B,77C,88C 'content':95C 'credenti':11A,23B,78C,101C 'cryptograph':44B,89C 'cve':12A,15A 'decrypt':9A,55B,92C 'detail':66B 'develop':69C 'devic':65B,103C 'get':51B 'hard':4A,21B,42B,76C,87C 'hard-cod':3A,41B,75C,86C 'hard-coded-credenti':20B 'inform':104C 'infortech':27B,38B,72C 'key':6A,45B,53B,90C 'let':7A 'login':10A,56B,93C 'mobil':24B,34B 'newtyp':26B,37B,71C 'newtype-infortech':25B 'nt':1A,18A,29B,31B,67C 'nt-oneapp':28B 'obtain':84C,97C 'oneapp':2A,19A,30B,32B,68C 'password':63B 'plaintext':61B,99C 'read':59B 'remot':48B,81C 'request':57B,94C 'ship':39B 'therebi':96C 'unauthent':47B,80C 'user':60B,98C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T05:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114219","severity":null,"published_at":"2026-10-22T05:16:49+00:00","modified_at":"2026-10-22T19:17:37+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114219:216","url":null,"severity":null,"published_at":"2026-10-23T22:24:05+00:00","modified_at":"2026-10-23T22:24:05+00:00","first_seen_at":"2026-10-23T22:24:05+00:00","fetched_at":"2026-10-23T22:24:05+00:00","note":"TWCERT/CC TVN-202610006 (primary coordinator) gives affected <=1.5.22, fix 1.5.35+. No exploitation or PoC found; not in KEV. Same advisory covers siblings CVE-2026-114220..114223 (likely mobile app: WebView, ADB backup, App PIN). Vendor's own page not found. NVD page returned empty."},{"source":"analyst","external_id":"CVE-2026-114219:305","url":null,"severity":null,"published_at":"2026-10-23T22:49:34+00:00","modified_at":"2026-10-23T22:49:34+00:00","first_seen_at":"2026-10-23T22:49:34+00:00","fetched_at":"2026-10-23T22:49:34+00:00","note":"No new sources since run 216. Added Aptoide version history: 1.5.35 (2026-07-25) labelled 'Security Patch fix', consistent with TWCERT fix version; 1.5.38 is newest Android build. Vendor's own advisory still not found; the app is sold only to NewType enterprise customers (Android pkg tw.com.newtype.ntoneapp, also on iOS App Store). Aptoide is a third-party mirror, so the label is corroboration, not a vendor statement."},{"source":"epss","external_id":"CVE-2026-114219","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114219","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1418,"url":"https://www.twcert.org.tw/en/cp-139-11306-e1a39-2.html","title":"TWCERT/CC TVN-202610006: NewType Infortech NT OneAPP - 5 Vulnerabilities","kind":"advisory","source":"analyst","text":"Affected: NT OneAPP 1.5.22 and earlier. Solution: update to NT OneAPP 1.5.35 or later. CVE-2026-114221 (Credential Disclosure): unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, obtaining the NUP Portal passcode of a logged-in user. Credit: Chiao-Lin Yu. Public 2026-10-22.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1426,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114219","title":"CVE Record CVE-2026-114219","kind":"other","source":"analyst","text":"Affected 0 through 1.5.22. CVSS 4.0 9.1, CVSS 3.1 7.4 (AC:H). CWE-798.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1623,"url":"https://nt-oneapp.en.aptoide.com/versions","title":"NT OneAPP version history (Aptoide)","kind":"release","source":"analyst","text":"Third-party mirror of Android builds. 1.5.38 (2026-08-08, GPS Fix); 1.5.35 (2026-07-25, 'Security Patch fix'); 1.5.33 (2026-07-10, Bug Fix); 1.5.15 (2026-02-02). Package tw.com.newtype.ntoneapp on Google Play.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}