CVE-2026-111494

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that…

Risk score: 60/100
CVSS: 9.1 v4.0
Published: 5 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including …
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 9.1 critical
Remotely exploitable without logging in

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

Original description

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

Last activity 5 Nov 2026. Patch Forecast updates every hour.