Live › vulnerability › CVE-2026-119736
The Attendo (formerly Petpooja Payroll) Admin Android app, version 3.0.13 and earlier, bundles production MQTT broker credentials in its Flutter configuration files. An attacker who decompiles the APK can connect to the production broker and read attendance records, personal identifiers, photos and authentication material, or publish messages to its topics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Organisations that use the Attendo (formerly Petpooja Payroll) Admin Android app for attendance and payroll, since the broker serves their employee data. Anyone who never installed version 3.0.13 or earlier can skip it. The sources do not say whether the broker has been rotated or restricted.
No product ranges from the sources yet.
3.0.13 and earlier are listed as affected.1883 is reachable from outside the vendor's own network.3.0.13; the exact fixed version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.
This page as .md · .json · in your agent: get_signal("CVE-2026-119736")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.