# TPC Software MatchPoint: static app credential, IDOR, and TLS bypass cluster (INCIBE-2026-841) · pwn.watch

> INCIBE-CERT coordinated disclosure of seven vulnerabilities in TPC Software's MatchPoint sports-facility management platform (INCIBE-2026-841, posted 2026-11-05). Three are critical: CVE-2026-111489 (CVSS v4 9.9) — a static credential embedded in the mobile app that returns an 'autorizado' token granting unauthenticated API access; CVE-2026-111490 (CVSS v4 9.9) — IDOR via the actingasuser HTTP header letting attackers reach personal, banking, and financial data, private messages, physical-access QR codes, and perform account takeover / balance transfers; CVE-2026-111494 (CVSS v4 9.1) — Android TrustManager accepts any TLS certificate and the app allows cleartext HTTP. Also high: local SQLi in the FCM push handler (CVE-2026-111492) and unauthenticated Images.ashx profile-photo enumeration (CVE-2026-111493). Medium: plaintext credentials in SQLite/SharedPreferences (CVE-2026-111491) and embedded APK config/keys (CVE-2026-111495). Vendor has already deployed server fixes for CVE-2026-111490 and CVE-2026-111493; INCIBE says install the latest app version for the rest. Reported by Sergi García Tárraga. No known exploitation stated in the advisory.

Page: https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026 · generated 2026-11-06T05:18:15.303Z

## Status
- Severity: critical · status: live · patch: partial
- Product: TPC Software MatchPoint
- Started: 2026-11-05
- CVEs: CVE-2026-111489, CVE-2026-111490, CVE-2026-111491, CVE-2026-111492, CVE-2026-111493, CVE-2026-111494, CVE-2026-111495
- Affected: MatchPoint platform / Android app versions prior to the latest release recommended by TPC Software (exact build numbers not published in INCIBE-2026-841)
- Fixed in: Server-side fixes for CVE-2026-111490 and CVE-2026-111493 already deployed by the vendor (apply regardless of app version); Latest available MatchPoint app version for the remaining CVEs (per INCIBE)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026.json
- This file: https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-05: INCIBE-CERT publishes INCIBE-2026-841 coordinating disclosure of seven MatchPoint (TPC Software) flaws: three critical (CVE-2026-111489 static mobile-app credential → 'autorizado' API token; CVE-2026-111490 IDOR via actingasuser header exposing personal/banking data and account takeover; CVE-2026-111494 Android TLS TrustManager accepts any cert / allows HTTP), plus high SQLi and unauth Images.ashx photo enum and medium plaintext-credential / embedded-config issues. Server fixes for CVE-2026-111490 and CVE-2026-111493 already deployed; remaining issues need the latest app version. Reported by Sergi García Tárraga. (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint)

## Fix brief
# Security brief: TPC Software MatchPoint: static app credential, IDOR, and TLS bypass cluster (INCIBE-2026-841)

Source: https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026 · status: live · severity: critical · updated Nov 6, 2026, 04:16 UTC

## Patch status
**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**

## What it is
INCIBE-CERT coordinated disclosure of seven vulnerabilities in TPC Software's MatchPoint sports-facility management platform (INCIBE-2026-841, posted 2026-11-05). Three are critical: CVE-2026-111489 (CVSS v4 9.9) — a static credential embedded in the mobile app that returns an 'autorizado' token granting unauthenticated API access; CVE-2026-111490 (CVSS v4 9.9) — IDOR via the actingasuser HTTP header letting attackers reach personal, banking, and financial data, private messages, physical-access QR codes, and perform account takeover / balance transfers; CVE-2026-111494 (CVSS v4 9.1) — Android TrustManager accepts any TLS certificate and the app allows cleartext HTTP. Also high: local SQLi in the FCM push handler (CVE-2026-111492) and unauthenticated Images.ashx profile-photo enumeration (CVE-2026-111493). Medium: plaintext credentials in SQLite/SharedPreferences (CVE-2026-111491) and embedded APK config/keys (CVE-2026-111495). Vendor has already deployed server fixes for CVE-2026-111490 and CVE-2026-111493; INCIBE says install the latest app version for the rest. Reported by Sergi García Tárraga. No known exploitation stated in the advisory.

Severity detail: CVSS v4 9.9 (CVE-2026-111489, CVE-2026-111490) and 9.1 (CVE-2026-111494); INCIBE importance 5 - Critical; no known exploitation stated

- Product: TPC Software MatchPoint
- CVE / advisory ids: CVE-2026-111489, CVE-2026-111490, CVE-2026-111491, CVE-2026-111492, CVE-2026-111493, CVE-2026-111494, CVE-2026-111495

## Affected versions
- MatchPoint platform / Android app versions prior to the latest release recommended by TPC Software (exact build numbers not published in INCIBE-2026-841)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Server-side fixes for CVE-2026-111490 and CVE-2026-111493 already deployed by the vendor (apply regardless of app version)
- Latest available MatchPoint app version for the remaining CVEs (per INCIBE)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Mitigations
The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Operators: confirm vendor server fixes are live for your tenant; update MatchPoint Android/mobile clients to the latest TPC Software release; treat any historically embedded 'autorizado'/static credential as compromised until rotated; review API access logs for actingasuser abuse and Images.ashx enumeration.

## Latest updates
- Nov 5, 2026: INCIBE-CERT publishes INCIBE-2026-841 coordinating disclosure of seven MatchPoint (TPC Software) flaws: three critical (CVE-2026-111489 static mobile-app credential → 'autorizado' API token; CVE-2026-111490 IDOR via actingasuser header exposing personal/banking data and account takeover; CVE-2026-111494 Android TLS TrustManager accepts any cert / allows HTTP), plus high SQLi and unauth Images.ashx photo enum and medium plaintext-credential / embedded-config issues. Server fixes for CVE-2026-111490 and CVE-2026-111493 already deployed; remaining issues need the latest app version. Reported by Sergi García Tárraga.

## Advisories
- [Multiple Vulnerabilities in TPC Software's MatchPoint (INCIBE-2026-841)](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint) (INCIBE-CERT)
- [CVE-2026-111489: static credential in MatchPoint mobile app returns 'autorizado' API token](https://www.cve.org/CVERecord?id=CVE-2026-111489) (CVE)
- [CVE-2026-111490: MatchPoint API IDOR via actingasuser header](https://www.cve.org/CVERecord?id=CVE-2026-111490) (CVE)
- [CVE-2026-111494: MatchPoint Android TrustManager accepts any TLS certificate](https://www.cve.org/CVERecord?id=CVE-2026-111494) (CVE)

## Caveats
Do not cite cve.now. Patch status partial because server fixes for CVE-2026-111490 and CVE-2026-111493 are deployed while remaining issues still require the latest MatchPoint app version (exact build not named in INCIBE-2026-841).

---
Machine-readable: https://pwn.watch/i/tpc-matchpoint-static-credential-idor-cluster-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.