Matchpoint vulnerabilities
CVEs whose affected-version data names the Matchpoint package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-111489Critical· 9.9A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
CVE-2026-111490Critical· 9.9Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers al…
CVE-2026-111491Medium· 6.9Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain …
CVE-2026-111493High· 8.7Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and coll…
CVE-2026-111492High· 8.6SQL injection in the push notification handler of the MatchPoint Android app
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the comp…
CVE-2026-111494Critical· 9.1Incorrect validation of TLS certificates in the MatchPoint Android app
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of …
CVE-2026-111495Medium· 5.1API keys, credentials, and configuration parameters embedded in the MatchPoint APK
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain o…