CVE-2026-111494 in MatchPoint
Summary
by MITRE • 11/06/2026
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in the MatchPoint Android application stems from fundamental failures in implementing secure transport layer security protocols. Specifically, the application utilizes a custom TrustManager that has been configured to accept any X.509 certificate presented by a server without performing proper validation against trusted root certificates or checking for revocation status. This configuration effectively disables certificate pinning and standard chain-of-trust verification mechanisms. Furthermore, the accompanying hostname validator is overly permissive, failing to ensure that the common name or subject alternative names in the presented certificate match the intended host address. These two flaws combined create a critical weakness where the application cannot distinguish between legitimate servers and malicious entities impersonating them.
This technical flaw directly facilitates man-in-the-middle attacks by allowing an attacker positioned within the network path, such as on a compromised Wi-Fi hotspot or through DNS spoofing, to intercept encrypted communications without detection. Because the client accepts any certificate, an adversary can generate a self-signed certificate for the target domain and present it during the TLS handshake. The application will establish the connection successfully, believing it is secure when in fact the encryption key is known to the attacker. This breaks the core promise of confidentiality and integrity provided by HTTPS, rendering cryptographic protections useless against passive eavesdropping or active modification attacks.
The operational impact of this vulnerability is severe, particularly given that the application handles sensitive user information including login credentials and personal data. An attacker exploiting this flaw can decrypt traffic in real-time to harvest usernames, passwords, session tokens, and other private details transmitted over the network. Beyond simple eavesdropping, the lack of integrity checks allows for active manipulation of the communication stream. The attacker could inject malicious payloads, alter transaction details, or redirect users to phishing pages while maintaining the appearance of a secure connection in the client interface. This compromises not only individual user privacy but also undermines trust in the application's security posture and potentially exposes backend systems if session tokens are reused elsewhere.
From a classification perspective, this vulnerability aligns with CWE-295 Improper Certificate Validation and CWE-319 Cleartext Transmission of Sensitive Information. The use of an unencrypted HTTP fallback further exacerbates the risk by allowing traffic to be exposed even before any TLS negotiation occurs or if certificate validation fails silently in some code paths, which corresponds to CWE-319 as well. In terms of adversary tactics, this flaw enables techniques associated with MITM and Credential Access via Network Sniffing within the ATT&CK framework, specifically T1048 Encryption for Evasion is bypassed because the attacker does not need to break encryption but rather tricks the client into trusting a fake endpoint.
To mitigate these risks, immediate remediation requires removing the custom TrustManager that accepts all certificates and replacing it with standard Android SSLContext implementations that enforce strict certificate chain validation against trusted system roots. The hostname verifier must be configured to strictly match domain names using appropriate algorithms such as StrictHostnameVerifier or equivalent logic that validates subject alternative names. Additionally, the application should disable cleartext HTTP traffic entirely by setting android:usesCleartextTraffic to false in the manifest and enforcing HTTPS-only connections through network security configuration files. Implementing certificate pinning would provide an additional layer of defense against compromised Certificate Authorities or sophisticated MITM attacks. Regular security audits and static analysis tools focused on cryptographic implementation should be integrated into the development lifecycle to prevent similar misconfigurations from being introduced in future updates.