Vulnerability details

CVE-2026-111489

TPC Software Matchpoint

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

CVSS 4.0

9.9Critical

Official description

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

CVSS scores

Score	Version	Source	Vector
9.9Critical	4.0	CVEProject cvelistV5 (CNA) (INCIBE)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`

Affected products

Vendor	Product	Versions	Source
TPC Software	Matchpoint	Versions prior to latest one	CVEProject cvelistV5 (CNA)

References and advisories

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-06
Last updated: 2026-11-06
State: Published
Assigner (CNA): INCIBE
Kolun priority: 21 · Low

Exploit prediction (EPSS)

0.31%

Probability of exploitation in 30 days

24.1%

Percentile (among all CVEs)