---
id: "CVE-2026-119736"
kind: "vulnerability"
aliases: ["CVE-2026-119736"]
title: "Attendo Admin Android app ships MQTT broker credentials, exposing employee data"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "attendo", "hr-systems", "mqtt", "other", "petpooja-payroll"]
not_affected_if: ["app-newer-than-3.0.13"]
published_at: "2026-11-02T19:18:02+00:00"
first_seen_at: "2026-11-02T19:24:39+00:00"
updated_at: "2026-11-02T19:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119736", "first_seen_at": "2026-11-02T19:24:39+00:00"}]
---

# Attendo Admin Android app ships MQTT broker credentials, exposing employee data

The Attendo (formerly Petpooja Payroll) Admin Android app, version 3.0.13 and earlier, bundles production MQTT broker credentials in its Flutter configuration files. An attacker who decompiles the APK can connect to the production broker and read attendance records, personal identifiers, photos and authentication material, or publish messages to its topics.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Attendo Admin app version; versions `3.0.13` and earlier are listed as affected.
- Confirm whether the broker at TCP port `1883` is reachable from outside the vendor's own network.

## Fix

- Attendo Admin Android app: update to a version later than `3.0.13`; the exact fixed version is unknown.

## Timeline

- 2026-11-02T19:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119736

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials

## From the sources

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_