Hard-Coded Credentials Vulnerability in Attendo Admin Android App by Petpooja

CVE-2026-119736

What is CVE-2026-119736?

The Attendo Admin Android application, specifically versions 3.0.13 and earlier, is susceptible to a vulnerability that involves hard-coded credentials. This security flaw permits unauthorized attackers to extract production MQTT broker credentials by reverse-engineering the app's APK and examining its bundled Flutter configuration assets, such as production.json and device-command files. With access to these credentials, malicious actors can connect to the MQTT broker over TCP port 1883, gaining access to sensitive messaging topics. This may expose critical data, including employee attendance records and personal identifiers, leading to potential misuse or unauthorized message injection.

References