---
id: CVE-2026-119736
title: Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
summary: >-
  Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13
  and earlier contains a hard-coded credentials vulnerability that allows
  attackers to extract production MQTT broker credentials by decompiling the
  APK's bundled…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-798
vendor: Petpooja
product: Attendo (formerly Petpooja Payroll)
affected:
  - attendo_formerly_petpooja_payroll <= 3.0.13
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T17:57:06.337922Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:56:27.145Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119736'
references:
  - url: >-
      https://medium.com/@TheWildEye/from-an-android-apk-to-production-mqtt-exposed-credentials-in-attendo-formerly-petpooja-payroll-eb701d23233e
    label: Researcher Disclosure
  - url: 'https://play.google.com/store/apps/details?id=com.petpooja.attendance'
    label: Android App
  - url: >-
      https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials
    label: >-
      VulnCheck Advisory: Attendo Admin Android 3.0.13 Hard-coded MQTT Broker
      Credentials
tags:
  - cve.org
  - exploit-available
epss: 0.00289
epssPercentile: 0.21589
ingestedAt: '2026-11-05T20:33:06.424Z'
---

## Overview

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

## Affected

- `attendo_formerly_petpooja_payroll <= 3.0.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.