CVE-2026-111494

Incorrect validation of TLS certificates in the MatchPoint Android app

publishedCWE-295

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

Technical severity9.1 criticalCVSS 4.0 · CNA: INCIBE

Published2026-11-05Source updated 2026-11-05

Collected2026-11-051 attributed source

Fixes and workarounds

Fix

The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.

Source: CNA: INCIBE

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Matchpoint TPC Software	Versions prior to latest one (affected) Other versions: unaffected	CNA: INCIBE

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
4.0 / 9.1 critical	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`	CNA: INCIBE

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpointCNA: INCIBE

For agents and automation

Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.

Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.

Get an API key Use x402 Connect an agent

Endpoints and access details

https://api.y2.dev/api/v2/cyber/cves
https://api.y2.dev/api/v2/cyber/cves/{cveId}

A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.

For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.

Agent access JSON · OpenAPI · CVE API guide