{"affected":[{"defaultStatus":"unaffected","product":"Matchpoint","source":"CNA: INCIBE","vendor":"TPC Software","versions":[{"status":"affected","version":"Versions prior to latest one"}]}],"cveId":"CVE-2026-111494","cwes":["CWE-295"],"description":"Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"CNA: INCIBE","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793915882432,"publishedAt":1793915882432,"references":[{"source":"CNA: INCIBE","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"}],"remediation":[{"kind":"fix","source":"CNA: INCIBE","text":"The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."}],"revision":"d47228a15de9e39039dd0d44da0a03fbd51ee1d2fe7cab573df922fa8652684d","sources":[{"modifiedAt":1793915882432,"name":"CNA: INCIBE","retrievedAt":1793916759418,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111494"}],"ssvc":null,"status":"published","title":"Incorrect validation of TLS certificates in the MatchPoint Android app","updatedAt":1793916759418}