Live › vulnerability › CVE-2026-114221
Go to dashboardNT OneAPP, an app from NewType Infortech, sends an HTTP Basic Authentication challenge from an unvalidated source inside its WebView under specific conditions. An unauthenticated remote attacker who triggers this can obtain the NUP Portal passcode of a logged-in user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone using the NT OneAPP mobile app from NewType Infortech at version 1.5.22 or earlier, mainly users who log in to the NUP Portal through its WebView. An attacker can trigger an HTTP Basic Auth prompt from an unvalidated source in the WebView and capture the portal passcode, so the user must interact. Organisations that do not use NT OneAPP can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NT OneAPP | vendor | <= 1.5.22 | 1.5.35 |
1.5.22 or earlier is affected; 1.5.35 or later is fixedUpdate NT OneAPP to version 1.5.35 or later
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
This page as .md · .json · in your agent: get_signal("CVE-2026-114221")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.