CVE-2026-114221— NewType Infortech｜NT OneAPP - Credential Disclosure
Quick assessment
Affected
NewType Infortech NT OneAPP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
由 NewType Infortech 开发的 NT OneAPP 存在凭据泄露漏洞。在特定条件下，未经身份验证的远程攻击者可在 WebView 中从未经验证的源触发 HTTP 基本身份验证挑战，从而获取已登录用户的 NUP 门户通行码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114221
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NewType Infortech｜NT OneAPP - Credential Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NewType Infortech | NT OneAPP | 0 ~ 1.5.22 | - |
|
II. Public POCs for CVE-2026-114221
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114221
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-114221 (2)
Same Patch Batch · NewType Infortech · 2026-10-22 · 5 CVEs total
| CVE-2026-114220 | 9.1 CRITICAL | NewType Infortech｜NT OneAPP - Improper Certificate Validation |
| CVE-2026-114219 | 7.4 HIGH | NewType Infortech｜NT OneAPP - Hard-coded Credentials |
| CVE-2026-114222 | 6.2 MEDIUM | NewType Infortech｜NT OneAPP - Authentication Bypass |
| CVE-2026-114223 | 5.5 MEDIUM | NewType Infortech｜NT OneAPP - Exposure of Sensitive Information |
IV. Related Vulnerabilities
Same product: NT OneAPP
Same vendor: NewType Infortech
-
CVE-2026-114223
NewType Infortech｜NT OneAPP - Exposure of Sensitive Informat -
CVE-2026-114222
NewType Infortech｜NT OneAPP - Authentication Bypass -
CVE-2026-114220
NewType Infortech｜NT OneAPP - Improper Certificate Validatio -
CVE-2026-114219
NewType Infortech｜NT OneAPP - Hard-coded Credentials -
CVE-2025-10267
NewType Infortech｜NUP Portal - Missing Authentication
Same weakness: CWE-522
-
CVE-2026-114070
Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Di -
CVE-2026-111765
A2A Java SDK: Android synchronous POST forwards credentials -
CVE-2026-111763
A2A Java SDK send client credentials under server-controlled -
CVE-2026-112303
GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader -
CVE-2026-111927
Coder before 2.35.4 Credential Theft via Workspace Proxy Hos
V. Comments for CVE-2026-114221
No comments yet