Skip to content
OpenAdvisories

Vendor

TPC Software

7 known vulnerabilities.

Products

Matchpoint 7
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-111494

    Incorrect validation of TLS certificates in the MatchPoint Android app

    Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victi…

    TPC Software Matchpoint
  • Critical 9.9
    CVE-2026-111490

    Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

    Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to persona…

    TPC Software Matchpoint
  • Critical 9.9
    CVE-2026-111489

    A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

    A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

    TPC Software Matchpoint