Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

MatchPoint Android app may let attackers read or change data

CVE-2026-111494 · published 4 days ago
Summary

The MatchPoint Android app does not properly verify security certificates and also allows unencrypted web traffic. Because of this, anyone who can intercept the phone's network connection could see or alter personal information and login details. Update to a version that correctly checks certificates and uses only encrypted connections, or limit use to trusted networks until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tpc software matchpoint Versions prior to latest one
Original advisory text
Incorrect validation of TLS certificates in the MatchPoint Android app
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
References
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-111494 · NVD
CVE-2026-111494 · MITRE
Track software like this
Free during beta