CVE-2026-111489A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

9.9 CRITICALEPSS 0.31%Not in KEVNVD: Deferred

Last updated: 2026-11-05 22:36 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.9	CRITICAL	4.0INCIBE (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Details

CVE ID: CVE-2026-111489
Status: Deferred
Assigner (CNA): INCIBE
Published: Nov 5, 2026
Last modified: 2026-11-05 22:36 UTC

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:15 UTC.