CRITICAL 9.9 NVD

CVE-2026-111489

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-

Published: 2026-11-05 · Source: NVD · Feed updated: 2026-11-06

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-11-05 via NVD.

Risk Timeline

CVE Disclosed2026-11-05 · 0 days ago

Remediation Resources

Official Advisory

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tp

vulnfeed aggregates 16809 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.