CVE-2026-119736 Details

A hard-coded credentials vulnerability has been identified in the Attendo Admin Android application, specifically in versions through 3.0.13. This vulnerability allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets, such as production.json and device-command configuration files. Once obtained, these credentials can be used to authenticate to the production MQTT broker over TCP port 1883. Attackers can then access messaging topics containing sensitive employee data, including attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material. Additionally, the vulnerability allows for the publication of messages to these topics, further exacerbating the exposure of sensitive information and enabling unauthorized message injection.