CVE-2026-111494

CriticalCVSS 9.1

Published: 05/11/2026(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Summary

The MatchPoint Android app incorrectly validates TLS certificates due to a TrustManager that accepts any certificate and a permissive hostname validator. The app also allows unencrypted HTTP traffic, enabling an attacker who intercepts traffic to read and modify communications, including credentials and personal data.

Risk Assessment

Traffic interception can lead to theft of credentials and personal data and to modification of communications.

Recommendation

Update the MatchPoint app to a version with proper certificate validation and enforced HTTPS; until then, avoid transmitting sensitive data.

Other vulnerabilities in MatchPoint Android app

CVE-2026-111492High
The MatchPoint Android app contains a SQL injection vulnerability in its push notification handler. The component processes Firebase Cloud Messaging messages and builds queries by concatenating untrusted data. An attacker able to interact with the component could manipulate queries and access sensitive information from the local database, including stored credentials.

Original NVD description (English source)

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS