---
id: "CVE-2026-114219"
kind: "vulnerability"
aliases: ["CVE-2026-114219"]
title: "NT OneAPP: hard-coded key lets attackers decrypt login credentials"
severity: "critical"
cvss: 9.1
epss: 0.00272
exploited: false
status: "open"
category: "other"
products: [{"name": "NT OneAPP", "fixed": ["1.5.35"], "affected": "<= 1.5.22", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["hard-coded-credentials", "mobile", "newtype-infortech", "nt-oneapp", "other"]
not_affected_if: ["version-1.5.35-or-later"]
published_at: "2026-10-22T05:16:49+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114219", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:24:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:49:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114219", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# NT OneAPP: hard-coded key lets attackers decrypt login credentials

NT OneAPP, a mobile app from NewType Infortech, ships a hard-coded cryptographic key. An unauthenticated remote attacker who gets that key can decrypt login requests and read users' plaintext account passwords and device details.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NT OneAPP affected <= 1.5.22 fixed 1.5.35

## How to check

Find the installed NT OneAPP version: Android Settings > Apps > NT OneAPP (package tw.com.newtype.ntoneapp), or the Google Play listing; on iOS, the App Store page or Settings > General > iPhone Storage > NT OneAPP. Versions 1.5.22 and earlier are affected; 1.5.35 or later is fixed. Enterprise customers can also check their MDM app inventory.

## Fix

Update NT OneAPP to 1.5.35 or later (1.5.38 is the latest Android build seen). Rotate credentials used with older versions.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114219
- 2026-10-23T22:24:05+00:00 analyst — TWCERT/CC TVN-202610006 (primary coordinator) gives affected <=1.5.22, fix 1.5.35+. No exploitation or PoC found; not in KEV. Same advisory covers siblings CVE-2026-114220..114223 (likely mobile app: WebView, ADB backup, App PIN). Vendor's own page not found. NVD page returned empty.
- 2026-10-23T22:49:34+00:00 analyst — No new sources since run 216. Added Aptoide version history: 1.5.35 (2026-07-25) labelled 'Security Patch fix', consistent with TWCERT fix version; 1.5.38 is newest Android build. Vendor's own advisory still not found; the app is sold only to NewType enterprise customers (Android pkg tw.com.newtype.ntoneapp, also on iOS App Store). Aptoide is a third-party mirror, so the label is corroboration, not a vendor statement.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114219

## Documents

- [advisory] TWCERT/CC TVN-202610006: NewType Infortech NT OneAPP - 5 Vulnerabilities https://www.twcert.org.tw/en/cp-139-11306-e1a39-2.html
- [describes] CVE Record CVE-2026-114219 https://www.cve.org/CVERecord?id=CVE-2026-114219
- [fix] NT OneAPP version history (Aptoide) https://nt-oneapp.en.aptoide.com/versions

## From the sources

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_