{"id":"CVE-2026-119736","kind":"vulnerability","aliases":["CVE-2026-119736"],"related":[],"title":"Attendo Admin Android app ships MQTT broker credentials, exposing employee data","description":"Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.","summary":"The Attendo (formerly Petpooja Payroll) Admin Android app, version 3.0.13 and earlier, bundles production MQTT broker credentials in its Flutter configuration files. An attacker who decompiles the APK can connect to the production broker and read attendance records, personal identifiers, photos and authentication material, or publish messages to its topics.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","attendo","hr-systems","mqtt","other","petpooja-payroll"],"not_affected_if":["app-newer-than-3.0.13"],"how_to_check":"- Check the installed Attendo Admin app version; versions `3.0.13` and earlier are listed as affected.\n- Confirm whether the broker at TCP port `1883` is reachable from outside the vendor's own network.","fix":"- Attendo Admin Android app: update to a version later than `3.0.13`; the exact fixed version is unknown.","status":"open","published_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:32+00:00","updated_at":"2026-11-02T19:26:32+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T19:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- Attendo Admin Android app: update to a version later than `3.0.13`; the exact fixed version is unknown.","reach":"internet","title":"Attendo Admin Android app ships MQTT broker credentials, exposing employee data","impact":"high","summary":"The Attendo (formerly Petpooja Payroll) Admin Android app, version 3.0.13 and earlier, bundles production MQTT broker credentials in its Flutter configuration files. An attacker who decompiles the APK can connect to the production broker and read attendance records, personal identifiers, photos and authentication material, or publish messages to its topics.","audience":"businesses","category":"other","nicknames":[],"who_cares":["attendo","petpooja-payroll","android","mqtt","hr-systems"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads employee data and injects messages into the production broker.","analyst_note":"Confirm the fixed Attendo Admin version and whether the exposed MQTT credentials were rotated; the vulncheck advisory is the only linked source.","how_to_check":"- Check the installed Attendo Admin app version; versions `3.0.13` and earlier are listed as affected.\n- Confirm whether the broker at TCP port `1883` is reachable from outside the vendor's own network.\n- unknown for anything else; the sources do not describe a vendor-side check.","plain_action":"","needs_analyst":true,"not_affected_if":["app-newer-than-3.0.13"],"who_is_affected":"Organisations that use the Attendo (formerly Petpooja Payroll) Admin Android app for attendance and payroll, since the broker serves their employee data. Anyone who never installed version 3.0.13 or earlier can skip it. The sources do not say whether the broker has been rotated or restricted.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4274,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119736':14A,17A '-2026':13A,16A '1883':138C '3.0.13':37B,86C 'access':139C 'admin':2A,33B,82C 'allow':97C 'android':3A,18B,34B,83C 'apk':55B,108C 'app':4A,35B 'applic':84C 'asset':113C 'attack':51B,98C,123C 'attend':64B,144C 'attendo':1A,19B,29B,78C 'authent':70B,130C,155C 'base64':149C 'base64-encoded':148C 'broker':7A,43B,61B,103C,135C 'bundl':40B,110C 'code':93C 'command':120C 'configur':48B,112C,121C 'connect':57B 'contain':89C,142C 'credenti':8A,44B,94C,104C,128C 'cve':12A,15A 'data':11A,168C 'decompil':53B,106C 'devic':119C,152C 'device-command':118C 'earlier':39B,88C 'employe':10A,143C 'encod':150C 'expos':9A 'exposur':165C 'extract':100C 'file':49B,122C 'flutter':47B,111C 'former':30B,79C 'hard':92C 'hard-cod':91C 'hr':21B 'hr-system':20B 'identifi':67B,147C 'inject':173C 'materi':71B,156C 'messag':74B,140C,159C,172C 'mqtt':6A,23B,42B,102C,134C 'payrol':27B,32B,81C 'person':66B,146C 'petpooja':26B,31B,80C 'petpooja-payrol':25B 'photo':68B 'photograph':151C 'potenti':170C 'product':41B,60B,101C,133C 'production.json':116C 'publish':73B,158C 'read':63B 'record':65B,145C 'recov':127C 'result':163C 'sensit':167C 'ship':5A 'system':22B 'tcp':137C 'telemetri':153C 'topic':77B,141C,162C 'unauthor':171C 'use':125C 'version':36B,85C 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":"Organisations that use the Attendo (formerly Petpooja Payroll) Admin Android app for attendance and payroll, since the broker serves their employee data. Anyone who never installed version 3.0.13 or earlier can skip it. The sources do not say whether the broker has been rotated or restricted.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","attendo","high","hrsystems","mqtt","other","petpoojapayroll"],"first_public_at":"2026-11-02T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119736","severity":null,"published_at":"2026-11-02T19:18:02+00:00","modified_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[{"id":53467,"url":"https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}