# CVE-2026-111494: TPC Software MatchPoint Android certificate validation bypass

Source: https://junglewise.ai/threats/cve-2026-111494-incorrect-validation-of-tls-certificates-in-the-matchpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-111494 · Severity: info · Published 2026-11-05

MatchPoint is a sports facility management platform with mobile and web components. The Android app does not properly validate TLS certificates and permits unencrypted HTTP traffic, allowing an attacker on the network to intercept and modify all communications, including login credentials and personal data.

Technologies: [TPC Software MatchPoint](https://junglewise.ai/threats/technologies/matchpoint). Vendors: [TPC Software](https://junglewise.ai/threats/vendors/tpc-software).

## Quick answers

**Is CVE-2026-111494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111494 being exploited in the wild.

**How severe is CVE-2026-111494?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** TPC Software MatchPoint <latest.

**Is there a fix for CVE-2026-111494?** Yes: fixed in latest available version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111494 attacked?** It is attacked over the network or from the adjacent network, in a web application.

**Am I affected by CVE-2026-111494?** Check whether you run TPC Software MatchPoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in latest available version

## Technical details

The Android app contains a permissive TrustManager that accepts any certificate and a hostname validator that does not properly enforce hostname verification (CWE-295). Combined with allowance of unencrypted HTTP, an attacker capable of traffic interception via network positioning (MITM, compromised network, ARP spoofing) can read and modify all app-server communications without user interaction or prior authentication. This enables credential theft and account compromise.

## Affected products

- TPC Software MatchPoint <latest

## Timeline

- 2026-11-05: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint)

## Related threats

- [TPC Software MatchPoint credentials and configuration extraction](https://junglewise.ai/threats/cve-2026-111495-api-keys-credentials-and-configuration-parameters-embedded-in)
- [TPC Software MatchPoint authentication bypass in Images.ashx endpoint](https://junglewise.ai/threats/cve-2026-111493-lack-of-authentication-and-authorization-in-the-images-ashx)
- [TPC Software MatchPoint SQL injection in push notification handler](https://junglewise.ai/threats/cve-2026-111492-sql-injection-in-the-push-notification-handler-of-the-matchpoint)
- [TPC Software MatchPoint authorization bypass in API](https://junglewise.ai/threats/cve-2026-111490-insecure-direct-object-reference-idor-vulnerability-in-the)
- [TPC Software MatchPoint hardcoded credential in mobile app](https://junglewise.ai/threats/cve-2026-111489-a-static-credential-embedded-in-the-mobile-app-has-been-reported)