CVE-2026-111491 in MatchPoint
Summary
by MITRE • 11/05/2026
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability described involves the insecure storage of sensitive authentication credentials within the MatchPoint Android application, specifically utilizing both an SQLite database and Android SharedPreferences for persistence. This architectural decision represents a fundamental failure in implementing secure data handling practices, as plaintext storage ensures that any entity with read access to the device's local file system can directly retrieve usernames and passwords without requiring cryptographic decryption or complex reverse engineering techniques. In modern mobile security frameworks, this flaw is classified under CWE-312, which defines Cleartext Storage of Sensitive Information, indicating a direct violation of confidentiality requirements for user data at rest. The presence of credentials in SharedPreferences further exacerbates the risk because these files are often backed up by default on many Android devices and can be accessed via standard debugging tools or file explorers if USB debugging is enabled or if the device has been compromised through other means such as malware installation or physical access during an unlocked session.
From a threat modeling perspective, this vulnerability aligns with ATT&CK Mobile Tactic TA0003, Persistence, and specifically relates to techniques involving credential harvesting from local storage. An attacker who gains access to the device's local data partition, either through rooting the device, exploiting another application-level vulnerability that allows file system read permissions, or by accessing a cloud backup of the app's private directory, can extract these plaintext credentials with minimal effort. The operational impact is severe because it bypasses all server-side authentication controls and multi-factor authentication mechanisms that might otherwise protect the account. Once obtained, these credentials allow for unauthorized access to user accounts on the platform, potentially leading to identity theft, financial fraud if payment information is linked, or further lateral movement within enterprise environments where users may reuse passwords across different services.
The mitigation strategy must focus on eliminating plaintext storage entirely and adopting industry-standard encryption mechanisms provided by the Android operating system. Developers should utilize the Android Keystore System in conjunction with EncryptedSharedPreferences for storing sensitive configuration data and credentials, ensuring that cryptographic keys are bound to hardware-backed security modules where available. For database-stored information, SQLCipher or similar transparent database encryption libraries should be implemented to encrypt all stored records at rest. Additionally, it is critical to disable automatic backups of the application's private data by setting android:allowBackup=false in the AndroidManifest.xml file and ensuring that sensitive fields are explicitly excluded from any backup mechanisms. Regular security audits and static analysis tools configured with rules for CWE-312 should be integrated into the continuous integration pipeline to detect such regressions before deployment, thereby maintaining a robust posture against local data exfiltration attacks.