Embedded API Keys Vulnerability in MatchPoint by TPC Software

CVE-2026-111495

What is CVE-2026-111495?

A security vulnerability exists in the MatchPoint APK, where embedded API keys, credentials, and configuration parameters are susceptible to extraction via reverse engineering. The vendor categorizes the extracted elements, including Google Maps and Firebase keys, as project identifiers intended for client-side use, rather than as sensitive authentication secrets. The potential impact of this vulnerability varies based on the capabilities and limitations associated with each exposed element, raising concerns about unauthorized access and abuse.

References