External risk intelligence

MatchPoint Static Credential Grants Unauthenticated API Access

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-111489

The vulnerability involves a hardcoded credential in a mobile application used to access API services on the MatchPoint platform. Since mobile applications frequently communicate with internet-facing backend APIs to function, this creates a common and expected path for internet exposure of the platform's API services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A static credential in the mobile application allows unauthenticated access to API services on the MatchPoint platform, posing a significant risk due to the ease of exploitation.

Hardcoded credentials grant unauthorized access to services.
Leadership should remember the ease of unauthorized access.
Confirm platform relevance and exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a static credential embedded within the mobile application to gain unauthorized access to API services on the MatchPoint platform. This embedded credential reportedly allows unauthenticated users to obtain an 'autorizado' token, which then grants access to these services.

Mobile app with embedded credential.
API call returning 'autorizado' token.
Unauthenticated access to API services.

Live Threat

Current exploitation, exposure, and threat context

A static credential embedded within the mobile application could allow unauthenticated access to API services on the MatchPoint platform, potentially exposing system data and sensitive information when supported by the advisory.

API services could be exposed.
Unauthenticated access via embedded credential.
Unauthorized access to platform data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability involves a static credential in a mobile app granting unauthenticated access to MatchPoint platform API services, suggesting ownership may fall to the mobile application team and the platform team responsible for the APIs. The first practical step is to inventory all instances of the mobile app, confirm API reachability and business criticality, identify the accountable owner, and then prioritize remediation based on risk.

Mobile and platform teams own the issue.
Verify API reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MatchPoint platform?

MatchPoint is a software platform that utilizes a companion mobile application to interact with backend API services. These services typically handle data processing and system functions, and the mobile app is designed to communicate with these APIs to provide users with mobile access to the platform's capabilities.

What does CVE-2026-111489 mean?

This CVE refers to a security weakness known as a hardcoded credential. In this specific case, the mobile application contains a static, embedded password or secret key that is automatically accepted by the MatchPoint platform. Because this credential is built directly into the app's code, it allows anyone to bypass standard login procedures and gain unauthorized access to API services.

How is this vulnerability triggered?

An attacker triggers this flaw by extracting the static credential from the mobile application and using it to authenticate against the MatchPoint API services. It is important to note that this bug does not require any user interaction or complex network manipulation; simply possessing the valid, hardcoded credential is sufficient to receive an 'autorizado' token and interact with the platform.

Is my system at risk?

According to Halo Surface Signal, this vulnerability is likely relevant if your MatchPoint platform APIs are accessible over the internet, as mobile applications often communicate with these services externally. If your infrastructure allows public or remote access to the endpoints served by this platform, the risk of unauthorized API interaction is higher.

What should I do first to address this?

You should begin by identifying which teams manage the mobile application and the backend API services. Create an inventory of all instances of the mobile app in your environment, then determine if those apps connect to internet-facing API endpoints. Once you understand your current reachability and the criticality of the data these services handle, you can coordinate with the owners to prioritize a security update.

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.