What is CVE-2026-119736?
CVE-2026-119736 is a high-severity security vulnerability with a CVSS score of 8.2 identified in the Attendo Admin Android application seguridad móvil. The flaw stems from hardcoded credentials categorized under CWE-798, leaving sensitive assets exposed within the mobile package.
As detailed in external security advisories like vulnerabilidad crítica, this issue compromises the confidentiality and integrity of messaging systems linked to the mobile application ecosystem.
Who is affected by this MQTT credential flaw?
The vulnerability impacts the Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier available via. Anyone using these specific legacy versions on mobile devices is exposed.
If you are managing devices running this software, it is comparable in severity to risks found in escalada de privilegios scenarios where hardcoded elements lead to full system compromise.
How does the vulnerability work?
Attackers can extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets, such as production.json and device-command configuration files.
Once recovered, these credentials permit authentication to the production MQTT broker over TCP port 1883, granting access to sensitive topics containing employee attendance records, personal identifiers, Base64-encoded photographs, and device telemetry.
How do I protect my systems?
Mitigating hardcoded credential risks requires strict adherence to secure coding practices and removing sensitive tokens from client-side binaries.
Follow these steps to protect your environment against exposure:
- Audit all deployed mobile applications for hardcoded configuration files or sensitive JSON assets.
- Update or uninstall vulnerable versions of the Attendo Admin Android application immediately.
- Revoke and rotate any exposed MQTT broker credentials and update ACL rules on TCP port 1883.
- Implement robust secret management systems instead of embedding tokens inside Flutter bundles.