CVE-2026-119736

The record

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

Affected packages

Related vulnerabilities

• CVE-2026-7003 WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that… CWE-798
• CVE-2026-61729 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-798
• CVE-2026-119662 Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows… CWE-798
• CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official website… CWE-798
• CVE-2026-118601 Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. CWE-798
• CVE-2026-18449 The BMC does not correctly enforce integrity and encryption requirements for IPMI… CWE-798
• CVE-2026-54631 Part-DB is an open source inventory management system for electronic components. CWE-798
• CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs… CWE-798