Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LiveCriticalPartly patchedPatch now

TPC Software MatchPoint: static app credential, IDOR, and TLS bypass cluster (INCIBE-2026-841)

TPC Software MatchPoint

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

INCIBE-CERT coordinated disclosure of seven vulnerabilities in TPC Software's MatchPoint sports-facility management platform (INCIBE-2026-841, posted 2026-11-05). Three are critical: CVE-2026-111489 (CVSS v4 9.9) — a static credential embedded in the mobile app that returns an 'autorizado' token granting unauthenticated API access; CVE-2026-111490 (CVSS v4 9.9) — IDOR via the actingasuser HTTP header letting attackers reach personal, banking, and financial data, private messages, physical-access QR codes, and perform account takeover / balance transfers; CVE-2026-111494 (CVSS v4 9.1) — Android TrustManager accepts any TLS certificate and the app allows cleartext HTTP. Also high: local SQLi in the FCM push handler (CVE-2026-111492) and unauthenticated Images.ashx profile-photo enumeration (CVE-2026-111493). Medium: plaintext credentials in SQLite/SharedPreferences (CVE-2026-111491) and embedded APK config/keys (CVE-2026-111495). Vendor has already deployed server fixes for CVE-2026-111490 and CVE-2026-111493; INCIBE says install the latest app version for the rest. Reported by Sergi García Tárraga. No known exploitation stated in the advisory.

Why this severity: CVSS v4 9.9 (CVE-2026-111489, CVE-2026-111490) and 9.1 (CVE-2026-111494); INCIBE importance 5 - Critical; no known exploitation stated

Started
Nov 5, 2026
CVEs
CVE-2026-111489CVE-2026-111490CVE-2026-111491CVE-2026-111492CVE-2026-111493CVE-2026-111494CVE-2026-111495

Follow this incident

Discuss on X ↗

Affected

  • MatchPoint platform / Android app versions prior to the latest release recommended by TPC Software (exact build numbers not published in INCIBE-2026-841)

Fixed in

  • Server-side fixes for CVE-2026-111490 and CVE-2026-111493 already deployed by the vendor (apply regardless of app version)
  • Latest available MatchPoint app version for the remaining CVEs (per INCIBE)

Timeline1

  1. INCIBE-CERT publishes INCIBE-2026-841 coordinating disclosure of seven MatchPoint (TPC Software) flaws: three critical (CVE-2026-111489 static mobile-app credential → 'autorizado' API token; CVE-2026-111490 IDOR via actingasuser header exposing personal/banking data and account takeover; CVE-2026-111494 Android TLS TrustManager accepts any cert / allows HTTP), plus high SQLi and unauth Images.ashx photo enum and medium plaintext-credential / embedded-config issues. Server fixes for CVE-2026-111490 and CVE-2026-111493 already deployed; remaining issues need the latest app version. Reported by Sergi García Tárraga.

Advisories4

Notes & caveats

Do not cite cve.now. Patch status partial because server fixes for CVE-2026-111490 and CVE-2026-111493 are deployed while remaining issues still require the latest MatchPoint app version (exact build not named in INCIBE-2026-841).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo