Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119736— Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

Quick assessment

Affected

Petpooja Attendo (formerly Petpooja Payroll)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Attendo（前身为 Petpooja Payroll）管理端 Android 应用程序 3.0.13 及更早版本存在硬编码凭证漏洞。攻击者可通过反编译 APK 中捆绑的 Flutter 配置资源（如 production.json 和 device-command 配置文件），提取生产环境 MQTT 代理的凭证。利用获取的凭证，攻击者可通过 TCP 1883 端口向生产环境 MQTT 代理进行身份认证，访问包含员工考勤记录、个人标识符、Base64 编码照片、设备遥测数据及认证材料等敏感信息的消息主题，并向这些

CVSS 8.2 · High EPSS 0.29% · P22 Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1078.004 · Cloud Accounts T1552.004 · Private Keys

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Petpooja	Munshi	`≤ 3.0.13`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

Source: CVE Program / CVE List V5

Vulnerability Description

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的凭证

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Petpooja	Attendo (formerly Petpooja Payroll)	0 ~ 3.0.13	-

II. Public POCs for CVE-2026-119736

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119736

请登录查看更多情报信息。

Other References for CVE-2026-119736 (3)

https://play.google.com/store/apps/details?id=com.petpooja.attendance product
https://medium.com/@TheWildEye/from-an-android-apk-to-production-mqtt-exposed-credentials-in-attendo-formerly-petpooja-payroll-eb701d23233e technical-description exploit
https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119736

Same Patch Batch · Petpooja · 2026-11-02 · 6 CVEs total

CVE-2026-119733	8.1 HIGH	Munshi Missing Authorization in Company Deletion API
CVE-2026-119731	7.5 HIGH	Munshi Payment Bypass via Unauthenticated Webhook Endpoint
CVE-2026-119734	6.5 MEDIUM	Munshi IDOR via Purchase Inquiry Thread Endpoint
CVE-2026-119732	6.5 MEDIUM	Munshi Broken Object Level Authorization via Invoice Deletion API
CVE-2026-119735	5.4 MEDIUM	Munshi XSS via Purchase Inquiry Thread Rendering

IV. Related Vulnerabilities

Same vendor: Petpooja

Same weakness: CWE-798