Is CVE-2026-111491 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111491 being exploited in the wild.

How severe is CVE-2026-111491?

Informational severity, published 5 November 2026.

Which products and versions are affected?

TPC Software MatchPoint Android app.

Is there a fix for CVE-2026-111491?

No fixed version is recorded yet. Install the latest available version of the MatchPoint Android app to address local credential storage vulnerabilities. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111491 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-111491?

Check whether you run TPC Software MatchPoint Android app. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111491: TPC Software MatchPoint Android plain text credential storage

CVE-2026-111491 · Severity: info · Published 2026-11-05

MatchPoint is a sports facility management platform that includes a mobile app storing user login credentials in unencrypted SQLite and SharedPreferences. An attacker with physical access to a device or its backup can extract credentials and use them to impersonate users on the platform, potentially gaining access to personal data, financial information, and facility access controls.

Vendors: TPC Software.

Quick answers

Is CVE-2026-111491 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111491 being exploited in the wild.
How severe is CVE-2026-111491?: Informational severity, published 5 November 2026.
Which products and versions are affected?: TPC Software MatchPoint Android app.
Is there a fix for CVE-2026-111491?: No fixed version is recorded yet. Install the latest available version of the MatchPoint Android app to address local credential storage vulnerabilities. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111491 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-111491?: Check whether you run TPC Software MatchPoint Android app. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Install the latest available version of the MatchPoint Android app to address local credential storage vulnerabilities.

Technical details

The MatchPoint Android app stores usernames and passwords in plain text in SQLite databases and SharedPreferences, vulnerable via CWE-256. An attacker with local access to the device's data or backups can retrieve these credentials without requiring authentication or network interaction. The vulnerability is compounded by SQL injection (CVE-2026-111492) in the local push notification handler, allowing account takeover once credentials are extracted.

Affected products

TPC Software MatchPoint Android app

Timeline

2026-11-05: disclosed

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.