{"id":"CVE-2026-114221","kind":"vulnerability","aliases":["CVE-2026-114221"],"related":[],"title":"NT OneAPP: WebView credential disclosure leaks NUP Portal passcode to remote attackers","description":"NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.","summary":"NT OneAPP, an app from NewType Infortech, sends an HTTP Basic Authentication challenge from an unvalidated source inside its WebView under specific conditions. An unauthenticated remote attacker who triggers this can obtain the NUP Portal passcode of a logged-in user.","severity":"high","cvss":7.4,"epss":0.00333,"exploited":false,"exploited_at":null,"products":[{"name":"NT OneAPP","fixed":["1.5.35"],"affected":"<= 1.5.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","mobile","nt-oneapp","nup-portal","other","webview"],"not_affected_if":["unknown"],"how_to_check":"Open NT OneAPP on the device and check the app version (Settings/About, or the app store listing). Version 1.5.22 or earlier is affected; 1.5.35 or later is fixed.","fix":"Update NT OneAPP to version 1.5.35 or later","status":"open","published_at":"2026-10-22T05:16:50+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:25:38+00:00","updated_at":"2026-10-25T03:26:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:25:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NT OneAPP: WebView credential disclosure leaks NUP Portal passcode to remote attackers","impact":"high","summary":"NT OneAPP, an app from NewType Infortech, sends an HTTP Basic Authentication challenge from an unvalidated source inside its WebView under specific conditions. An unauthenticated remote attacker who triggers this can obtain the NUP Portal passcode of a logged-in user.","category":"other","nicknames":[],"who_cares":["nt-oneapp","nup-portal","mobile"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker obtains a logged-in user's NUP Portal passcode","analyst_note":"Find the vendor advisory or NVD detail for the affected NT OneAPP versions, the exact trigger conditions, and the vendor fix; sources at https://nvd.nist.gov/vuln/detail/CVE-2026-114221.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Users of NT OneAPP who are logged in to the NUP Portal and visit or receive content that triggers the WebView authentication challenge. The sources do not say which app versions or specific conditions are involved, so teams should check whether they deploy or use NT OneAPP.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000589,"input_tokens":3360,"output_tokens":505,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or NVD detail for the affected NT OneAPP versions, the exact trigger conditions, and the vendor fix; sources at https://nvd.nist.gov/vuln/detail/CVE-2026-114221.","search":"'-114221':15A,18A '-2026':14A,17A 'android':21B 'app':34B 'attack':12A,57B,86C 'authent':42B,92C 'basic':41B,91C 'challeng':43B,93C 'condit':53B,103C 'credenti':4A,81C 'cve':13A,16A 'develop':75C 'disclosur':5A,82C 'http':40B,90C 'infortech':37B,78C 'insid':48B 'leak':6A 'log':70B,113C 'logged-in':69B,112C 'mobil':22B 'newtyp':36B,77C 'nt':1A,19A,24B,31B,73C 'nt-oneapp':23B 'nup':7A,27B,64B,107C 'nup-port':26B 'obtain':62B,105C 'oneapp':2A,20A,25B,32B,74C 'passcod':9A,66B,109C 'portal':8A,28B,65B,108C 'remot':11A,56B,85C 'send':38B 'sourc':47B,97C 'specif':52B,102C 'therebi':104C 'trigger':59B,88C 'unauthent':55B,84C 'unvalid':46B,96C 'user':72B,115C 'vulner':83C 'webview':3A,30B,50B,100C","nicknames":[],"mitigations":[],"who_affected":"Anyone using the NT OneAPP mobile app from NewType Infortech at version 1.5.22 or earlier, mainly users who log in to the NUP Portal through its WebView. An attacker can trigger an HTTP Basic Auth prompt from an unvalidated source in the WebView and capture the portal passcode, so the user must interact. Organisations that do not use NT OneAPP can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:26:51Z","by":"analyst","run_id":717},"who_affected":{"at":"2026-10-25T03:26:51Z","by":"analyst","run_id":717}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T05:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114221","severity":null,"published_at":"2026-10-22T05:16:50+00:00","modified_at":"2026-10-22T15:31:24+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114221","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114221","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114221:717","url":null,"severity":null,"published_at":"2026-10-25T03:26:51+00:00","modified_at":"2026-10-25T03:26:51+00:00","first_seen_at":"2026-10-25T03:26:51+00:00","fetched_at":"2026-10-25T03:26:51+00:00","note":"TWCERT/CC TVN-202610006 (CNA) read: affected <=1.5.22, fixed 1.5.35. No exploitation or PoC found; no vendor page, no discussion found. Exact trigger conditions not published. Sibling CVEs 114219-114223 share the advisory."}],"documents":[{"id":1418,"url":"https://www.twcert.org.tw/en/cp-139-11306-e1a39-2.html","title":"TWCERT/CC TVN-202610006: NewType Infortech NT OneAPP - 5 Vulnerabilities","kind":"advisory","source":"analyst","text":"Affected: NT OneAPP 1.5.22 and earlier. Solution: update to NT OneAPP 1.5.35 or later. CVE-2026-114221 (Credential Disclosure): unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, obtaining the NUP Portal passcode of a logged-in user. Credit: Chiao-Lin Yu. Public 2026-10-22.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}