{"id":"CVE-2026-111494","title":"Incorrect validation of TLS certificates in the MatchPoint Android app","summary":"Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-295"],"vendor":"TPC Software","product":"Matchpoint","affected":["Matchpoint Versions prior to latest one"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:58:02.432Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111494","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T23:41:31.958Z","epss":0.00162,"epssPercentile":0.05457,"slug":"CVE-2026-111494","body":"## Overview\n\nIncorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.\n\n## Affected\n\n- `Matchpoint Versions prior to latest one`\n\n## Remediation\n\nThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}