Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Workaround: The checked facts give no vendor fix or workaround. Until a patched release is available, the only limit the facts support is to stop using the Attendo Admin Android app, since its embedded credentials are the problem.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Attendo Admin Android app (formerly Petpooja Payroll) is affected, allowing anyone who decompiles the app to recover credentials for its production messaging broker. An attacker could then read sensitive employee data such as attendance records, personal identifiers, photographs, and authentication material, and inject unauthorized messages.
Read the original description
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.
What to do
Workaround: The checked facts give no vendor fix or workaround. Until a patched release is available, the only limit the facts support is to stop using the Attendo Admin Android app, since its embedded credentials are the problem.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Petpooja Munshi
through 3.0.13
Evidence 3
- Exploit
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-119736
What does this mean?
The Attendo Admin Android app ships production MQTT broker login credentials inside its bundled Flutter configuration files, so anyone who decompiles the APK can read them. With those credentials, a person can connect to the production broker and read or publish messages on its topics, which hold employee attendance records, personal identifiers, photographs, device telemetry and authentication material.Source: vulncheck.com
Am I affected, and how do I check?
Attendo Admin Android application version 3.0.13 and earlier, which was formerly sold as Petpooja Payroll, is listed as affected. To check the version, open the app's information or About screen in Android settings and compare the version number with 3.0.13.Source: vulncheck.com
What should I do about it?
No fixed version is listed in the checked facts, so there is no confirmed upgrade target yet. Watch the vendor's channels for an update to a release later than 3.0.13.Source: vulncheck.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts give no vendor fix or workaround. Until a patched release is available, the only limit the facts support is to stop using the Attendo Admin Android app, since its embedded credentials are the problem.Source: vulncheck.com