External risk intelligence

NewType OneAPP Hard-coded Credentials Allow Account Theft

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-114219

The vulnerability affects a network-based application (OneAPP) that processes login requests. As an application designed to manage user authentication and device information, it is commonly deployed as an internet-facing or remote-access service to facilitate user connectivity, making it plausibly reachable from the public internet in typical deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in NewType Infortech's NT OneAPP software that could allow unauthenticated attackers to obtain user credentials and device information. The issue stems from hard-coded credentials within the application, which, if exploited, could lead to the decryption of sensitive login request data.

Weak credentials expose user accounts and device data.
This affects how users remotely access systems.
Verify if NT OneAPP is in use; assess exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted requests to the NT OneAPP. If successful, they can obtain sensitive user credentials and device information.

No authentication or prior access is needed.
Vulnerable component handles login requests.
Risk of credential theft and device compromise.

Live Threat

Current exploitation, exposure, and threat context

A hard-coded cryptographic key in NT OneAPP could allow unauthenticated remote attackers to decrypt login requests. This could expose users' plaintext account credentials and device information.

User account credentials and device data at risk.
Decrypting login requests via network access.
Unauthorized access to user accounts and devices.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NewType Infortech OneAPP, due to hard-coded credentials, poses a critical risk by allowing unauthenticated remote attackers to access sensitive user and device information. Ownership of this vulnerability likely resides with the application owner and potentially the platform or infrastructure teams managing its deployment, with a primary first step being to identify all instances of OneAPP, confirm their exposure and business criticality, and then engage the relevant teams for remediation planning.

Application owners and platform teams
Verify OneAPP deployment and reachability
Plan remediation based on identified risk

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NT OneAPP used for?

NT OneAPP by NewType Infortech is a software solution designed to manage user authentication and device information. It functions as a gateway for remote access, allowing users to connect to systems or services. Because it handles the intake and processing of login requests, it serves as a central point for identity verification within the environments where it is deployed.

How does CVE-2026-114219 work?

This vulnerability involves 'Hard-coded Credentials' (CWE-798). The application contains an embedded, static cryptographic key used to protect login data. Because this key is built into the software rather than generated uniquely for each installation, an attacker who gains access to the key can use it to reverse the encryption on intercepted login traffic, exposing plaintext usernames, passwords, and device details.

Do I need authentication to trigger this?

No, this vulnerability does not require any prior authentication or special user privileges. An attacker simply needs network access to the application to send requests. It is important to note that this is not triggered by normal user activity; it requires the active use of the hard-coded key to decrypt data, which is only possible if an attacker targets the specific cryptographic mechanism used by the app.

Is my deployment at risk?

Halo Surface Signal notes that because NT OneAPP manages login requests and remote access, it is frequently deployed as an internet-facing service. If your instance is reachable from the public internet, it faces a higher likelihood of being targeted. You should evaluate whether your specific deployment is exposed to the internet or restricted to internal network segments.

What should I do first to address this?

Your first step is to conduct an internal audit to identify all running instances of NT OneAPP. Once you have a complete inventory, determine the network reachability of each instance to prioritize those accessible from the outside. Coordinate with your platform and infrastructure teams to discuss remediation plans and minimize the attack surface until official updates or configuration changes are available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.