---
id: CVE-2026-111494
title: Incorrect validation of TLS certificates in the MatchPoint Android app
summary: >-
  Incorrect validation of TLS certificates in the MatchPoint Android app due to
  a TrustManager that accepts any certificate and a permissive hostname
  validator. Additionally, the app allows unencrypted HTTP traffic. An attacker
  capable of …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: TPC Software
product: Matchpoint
affected:
  - Matchpoint Versions prior to latest one
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:58:02.432Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111494'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.958Z'
epss: 0.00162
epssPercentile: 0.05457
---

## Overview

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

## Affected

- `Matchpoint Versions prior to latest one`

## Remediation

The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.