Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-119736Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

High 8.2

In plain English

A high-severity hard-coded credentials in Attendo (formerly Petpooja Payroll) from Petpooja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

Affected products (as reported)

Vendor	Product	Versions
Petpooja	Attendo (formerly Petpooja Payroll)	0 – through 3.0.13

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

Researcher Disclosure technical-description, exploit
Android App product
VulnCheck Advisory: Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials third-party-advisory