Vulnerability · Published Nov 5, 2026 · Assigned by INCIBE
CVE-2026-111489A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
Critical 9.9
In plain English
A critical-severity security flaw in Matchpoint from TPC Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 4.0)9.9Critical
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |