---
id: "CVE-2026-114221"
kind: "vulnerability"
aliases: ["CVE-2026-114221"]
title: "NT OneAPP: WebView credential disclosure leaks NUP Portal passcode to remote attackers"
severity: "high"
cvss: 7.4
epss: 0.00333
exploited: false
status: "open"
category: "other"
products: [{"name": "NT OneAPP", "fixed": ["1.5.35"], "affected": "<= 1.5.22", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "mobile", "nt-oneapp", "nup-portal", "other", "webview"]
not_affected_if: ["unknown"]
published_at: "2026-10-22T05:16:50+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:26:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114221", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114221", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:26:51+00:00"}]
---

# NT OneAPP: WebView credential disclosure leaks NUP Portal passcode to remote attackers

NT OneAPP, an app from NewType Infortech, sends an HTTP Basic Authentication challenge from an unvalidated source inside its WebView under specific conditions. An unauthenticated remote attacker who triggers this can obtain the NUP Portal passcode of a logged-in user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NT OneAPP affected <= 1.5.22 fixed 1.5.35

## How to check

Open NT OneAPP on the device and check the app version (Settings/About, or the app store listing). Version 1.5.22 or earlier is affected; 1.5.35 or later is fixed.

## Fix

Update NT OneAPP to version 1.5.35 or later

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114221
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114221
- 2026-10-25T03:26:51+00:00 analyst — TWCERT/CC TVN-202610006 (CNA) read: affected <=1.5.22, fixed 1.5.35. No exploitation or PoC found; no vendor page, no discussion found. Exact trigger conditions not published. Sibling CVEs 114219-114223 share the advisory.

## Documents

- [advisory] TWCERT/CC TVN-202610006: NewType Infortech NT OneAPP - 5 Vulnerabilities https://www.twcert.org.tw/en/cp-139-11306-e1a39-2.html

## From the sources

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_