CVE-2026-111495 Details
Description
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
A vulnerability exists in the MatchPoint Android application by TPC Software, allowing for the extraction of API keys, credentials, and configuration parameters through reverse engineering. These elements, embedded within the APK, are considered project identifiers by the vendor, distinct from Google Maps and Firebase keys that must remain client-side. The impact of this vulnerability varies based on the capabilities and restrictions of each exposed element.
Users are advised to install the latest available version of the MatchPoint application. The manufacturer has deployed server fixes for some related vulnerabilities, which are applied regardless of the app version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| TPC Software MatchPoint | All versions |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |