CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint Android app

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.

9.1 CRITICALEPSS 0.16%Not in KEVNVD: Deferred

Last updated: 2026-11-05 22:36 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.1	CRITICAL	4.0INCIBE (CNA)	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Details

CVE ID: CVE-2026-111494
Status: Deferred
Assigner (CNA): INCIBE
Published: Nov 5, 2026
Last modified: 2026-11-05 22:36 UTC
Weaknesses: CWE-295 · Improper certificate validation

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:21 UTC.