Sergi García Tárraga

API keys, credentials, and configuration parameters embedded in the MatchPoint APK

Incorrect validation of TLS certificates in the MatchPoint Android app

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint

SQL injection in the push notification handler of the MatchPoint Android app

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform