---
id: CVE-2026-111491
title: >-
  Credentials are stored in plain text in an SQLite database and in the
  MatchPoint Android app's SharedPreferences
summary: >-
  Credentials are stored in plain text in an SQLite database and in the
  MatchPoint Android app's SharedPreferences. An attacker with access to the
  device's local data or a backup could retrieve usernames and passwords and use
  them to gain …
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-256
vendor: TPC Software
product: Matchpoint
affected:
  - Matchpoint Versions prior to latest one
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:51:47.817Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111491'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.960Z'
epss: 0.00119
epssPercentile: 0.01769
---

## Overview

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.

## Affected

- `Matchpoint Versions prior to latest one`

## Remediation

The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.