The vulnerability allows the extraction of API keys, credentials, and configuration parameters that are embedded in the MatchPoint APK. Reverse engineering the application can reveal these secrets, which may grant attackers access to external services linked to the application. The extent of damage depends on the permissions and capabilities granted to each exposed key, ranging from limited service access to full control of associated resources.

TPC Software’s MatchPoint application, specifically all versions prior to the latest released version.

The vulnerability scores a CVSS of 5.1, indicating a moderate threat level. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The most likely route for exploitation is local reverse engineering of the application on a device or in a network that has access to the APK, as the secrets are embedded in client-side code. Once extracted, an attacker could authenticate to services such as Google Maps or Firebase depending on the exposed elements, which may lead to data leakage or unauthorized service usage.